26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.9551.Generic Sample 2af86dcc149f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2af86dcc149f…. Malware family: Dacic.9551.Generic. Threat score 100/100. 14/27 AV engines flagged this file. 7 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073","keywords":["Malicious","Dacic.9551.Generic","malware analysis","sandbox report","threat intelligence","2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073"],"about":{"@type":"SoftwareApplication","name":"2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin","applicationCategory":["peexe","executable"],"identifier":"2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.9551.Generic","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tca2,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")28:T89a,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")29:T592,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")2a:T5b2,Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")2b:Taa6,Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-245-004504A4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-245-004504A4 Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-1633-00455274 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-1633-00455274 Assembly shows XOR instruction xor esi dword ptr [00478DD4h] in Stream UID: 62703-2286-0043A761 Assembly shows XOR instruction xor esi dword ptr [00478DD0h] in Stream UID: 62703-2289-0043A83F Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2329-0044E64D Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-2329-0044E64D Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2330-0044E78F Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-2330-0044E78F Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2870-0043A656 Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2889-0043C80F Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-2889-0043C80F Assembly shows XOR instruction xor esi dword ptr [0047800Ch] in Stream UID: 62703-2890-0043CAB4 Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2905-0043C77E Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2964-00454DBF Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-2964-00454DBF Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2989-0044C0C6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-2989-0044C0C6 Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2990-0045935B Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-2990-0045935B Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-2991-00459260 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-2991-00459260 Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-3003-0044E4F4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-3003-0044E4F4 Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-3004-0044E54A Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-3004-0044E54A Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-3022-004585AC Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-3022-004585AC Assembly shows XOR instruction xor eax ebp in Stream UID: 62703-3024-004587FC Assembly shows XOR instruction xor ecx ebp in Stream UID: 62703-3024-004587FC Assembly shows XOR instruction xor eax dword ptr [0047800Ch] in Stream UID: 62703-3513-0043C3FD Assembly shows XOR instruction xor eax dword ptr [0047800Ch] in Stream UID: 62703-4108-0043C30D2c:Tdb2,Found string "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----END RSA PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----BEGIN PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----END PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----END ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----END EC PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----BEGIN DSA PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----END DSA PRIVATE KEY-----" (Indicator: "private key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "-----BEGIN RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----END RSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----BEGIN PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----END PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----END ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----BEGIN EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----END EC PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----BEGIN DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----END DSA PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")2d:T842,Found XOR loop in file "sample.bin" at offset 422618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 511263; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 516019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 523023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 525521; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 21681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 101742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 130528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 236022; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 239337; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 254215; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 254344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 511367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 514691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 516061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 423708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 436058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 514824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 523004; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 525144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 525506; code bytes = 80302e:T432,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "GetLastInputInfo" (Indicator: "GetLastInputInfo"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")2f:T830,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")30:T47a,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")31:T434,Found system information discovery API: "GetNativeSystemInfo" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found system information discovery API: "ExpandEnvironmentStringsA" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found system information discovery API: "GetMonitorInfoW" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found system information discovery API: "GetMonitorInfoW" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp"32:T61a,Found reference to API "FindFirstVolumeW" (Indicator: "FindFirstVolume"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathName"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FindFirstVolumeW" (Indicator: "FindFirstVolume"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")33:T4a2,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")34:T4a2,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")35:T79f,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "3634827376,1568,109,,GetWindowTextW,user32.dll,"00:44:17.234",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp") Found reference to API "55743528629,6556,109,,GetWindowTextW,user32.dll,"00:44:38.953",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00004000.00000001.172186.034B0000.00000004.mdmp") Found reference to API "128553745884,6188,109,,GetWindowTextW,user32.dll,"00:45:09.281",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00004000.00000002.174105.034B0000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "347130544399,7016,109,,GetWindowTextW,user32.dll,"00:46:40.359",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00004000.00000003.179608.034B0000.00000004.mdmp")36:T49c,Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "EnumServicesStatusW" (Indicator: "EnumServicesStatus"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")37:T5d9,"" (Indicator: "GetDC"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")44:T728,Found registry query API: "RegQueryValueExA" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found registry query API: "RegEnumKeyExA" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found registry query API: "RegQueryInfoKeyW" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found registry query API: "RegOpenKeyExW" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found registry query API: "RegQueryValueExW" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found registry query API: "RegEnumValueW" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found registry query API: "RegEnumKeyExW" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found registry query API: "RegOpenKeyExA" in file "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin" Found registry query API: "RegQueryValueExW" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00004000.00000003.179608.0045E000.00000002.mdmp"45:T4f2,Found string "ZipFiles" (Indicator: "zipfile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "UnzipFiles" (Indicator: "zipfile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "SHA256wECDSA" (Indicator: "ecdsa"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes128"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "ZipFiles" (Indicator: "zipfile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "UnzipFiles" (Indicator: "zipfile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "SHA256wECDSA" (Indicator: "ecdsa"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes128"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")46:T590,Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")47:Tbd2,Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")48:T81a,Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")49:Tc37,Found string "[Tab]" (Indicator: "[tab]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[Alt]" (Indicator: "[alt]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[Alt]" (Indicator: "[Alt]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[Pause]" (Indicator: "[pause]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[Esc]" (Indicator: "[esc]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[End]" (Indicator: "[end]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[Left]" (Indicator: "[left]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[Right]" (Indicator: "[right]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[Down]" (Indicator: "[down]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[F10]" (Indicator: "[F10]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[F11]" (Indicator: "[F11]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[F12]" (Indicator: "[F12]"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found string "[Tab]" (Indicator: "[tab]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[Alt]" (Indicator: "[alt]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[Alt]" (Indicator: "[Alt]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[Pause]" (Indicator: "[pause]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[Esc]" (Indicator: "[esc]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[End]" (Indicator: "[end]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[Left]" (Indicator: "[left]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[Right]" (Indicator: "[right]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[Down]" (Indicator: "[down]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")4a:T7ea,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin"), Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin"), Found reference to API "").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp"), Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp"), Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp"), Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp"), Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004000.00000003.179608.0045E000.00000002.mdmp")4b:T9c5,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69deb31abc6fea79650c674e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004000.00000003.179608.0045E000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004000.00000003.179608.0045E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69deb31abc6fea79650c674e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004000.00000000.170266.034B0000.00000004.mdmp, 00000000-00004000.00000001.172186.034B0000.00000004.mdmp, 00000000-00004000.00000002.174105.034B0000.00000004.mdmp, 00000000-00004000.00000003.179608.034B0000.00000004.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00004000.00000003.179608.0045E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69deb31abc6fea79650c674e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69deb31abc6fea79650c674e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"