24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 47e8a43a5dfc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 47e8a43a5dfc…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34"],"about":{"@type":"SoftwareApplication","name":"image001.exe","applicationCategory":["peexe","executable"],"identifier":"47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tf0e,"image001.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000048c9bb0038cf41776c301403b4c9bb0001000000203014036c30140320301403040000000400000000e0dc7400100000b4c9bb000100000020301403cd9741779c974177d17623b5b50fd374203014030000417700000000441921740000000080eed9740100000000000000f8e2dc740000000004000000000000004840db74f8e2dc74b8c9bb0080e83575509e140380e83575b4c9bb000000000080e8357500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b6d21603ccd21603 (UID: 00000000-00004160) "image001.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6d11603eed11603 (UID: 00000000-00004160) "image001.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006e18170382181703 (UID: 00000000-00004160) "image001.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002e20170346201703 (UID: 00000000-00004160) "image001.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006e28170386281703 (UID: 00000000-00004160) "image001.exe" called "RtlGetVersion" (UID: 00000000-00004160) "image001.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004160)26:T595,Observed string:"EnumSystemLocalesA" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"EnumSystemLocalesW" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"GetLocaleInfoA" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"GetLocaleInfoEx" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"GetLocaleInfoW" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"GetSystemDefaultLCID" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"GetUserDefaultLCID" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"kernel32.EnumSystemLocalesA" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"kernel32.EnumSystemLocalesW" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"kernel32.GetLocaleInfoA" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"kernel32.GetLocaleInfoEx" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"kernel32.GetLocaleInfoW" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"kernel32.GetSystemDefaultLCID" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403] Observed string:"kernel32.GetUserDefaultLCID" [Source: api-ms-win-core-localization-l1-2-0.dll.3809801403]27:T5b5,"image001.exe" called "CreateDirectoryA" with parameter %TEMP%\ (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter C:\Users\%OSUSER% (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %TEMP%\nsrB7D0.tmp (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\Administrationsgrundlag (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\Administrationsgrundlag\Handlingsreferater (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens\Sollyset (UID: 00000000-00004160) "image001.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens\Sollyset\Fungerende (UID: 00000000-00004160)28:T5c9,"image001.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter show (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004160) "image001.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004160)29:T743,"libenchant-2.dll" contains export function called "enchant_broker_describe" at ordinal 1 "libenchant-2.dll" contains export function called "enchant_broker_dict_exists" at ordinal 2 "libenchant-2.dll" contains export function called "enchant_broker_free" at ordinal 3 "libenchant-2.dll" contains export function called "enchant_broker_free_dict" at ordinal 4 "libenchant-2.dll" contains export function called "enchant_broker_get_error" at ordinal 5 "libenchant-2.dll" contains export function called "enchant_broker_init" at ordinal 6 "libenchant-2.dll" contains export function called "enchant_broker_list_dicts" at ordinal 7 "libenchant-2.dll" contains export function called "enchant_broker_request_dict" at ordinal 8 "libenchant-2.dll" contains export function called "enchant_broker_request_pwl_dict" at ordinal 9 "libenchant-2.dll" contains export function called "enchant_broker_set_ordering" at ordinal 10 "libenchant-2.dll" contains export function called "enchant_dict_add" at ordinal 11 "libenchant-2.dll" contains export function called "enchant_dict_add_to_session" at ordinal 12 "libenchant-2.dll" contains export function called "enchant_dict_check" at ordinal 13 "libenchant-2.dll" contains export function called "enchant_dict_describe" at ordinal 14 "libenchant-2.dll" contains export function called "enchant_dict_free_string_list" at ordinal 15 "libenchant-2.dll" contains export function called "enchant_dict_get_error" at ordinal 16 "libenchant-2.dll" contains export function called "enchant_dict_get_extra_word_characters" at ordinal 17 "libenchant-2.dll" contains export function called "enchant_dict_is_added" at ordinal 18 "libenchant-2.dll" contains export function called "enchant_dict_is_removed" at ordinal 19 "libenchant-2.dll" contains export function called "enchant_dict_is_word_character" at ordinal 202a:T11d2a,Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "AppendMenuA" (Indicator: "AppendMenuA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "BeginPaint" (Indicator: "BeginPaint"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "BitBlt" (Indicator: "BitBlt"; in File: "AdvSplash.dll.2808196158") Found string "CallWindowProcA" (Indicator: "CallWindowProcA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CharNextA" (Indicator: "CharNextA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CloseClipboard" (Indicator: "CloseClipboard"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CloseHandle" (Indicator: "CloseHandle"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CLSIDFromString" (Indicator: "CLSIDFromString"; in File: "System.dll.3929894841") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CopyFileA" (Indicator: "CopyFileA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CoTaskMemFree" (Indicator: "CoTaskMemFree"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; in File: "AdvSplash.dll.2808196158") Found string "CreateDirectoryA" (Indicator: "CreateDirectoryA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CreateFileA" (Indicator: "CreateFileA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CreateFontIndirectA" (Indicator: "CreateFontIndirectA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CreatePopupMenu" (Indicator: "CreatePopupMenu"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CreateProcessA" (Indicator: "CreateProcessA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CreateThread" (Indicator: "CreateThread"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "CreateWindowExA" (Indicator: "CreateWindowExA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "DefWindowProcA" (Indicator: "DefWindowProcA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "DeleteDC" (Indicator: "DeleteDC"; in File: "AdvSplash.dll.2808196158") Found string "DeleteFileA" (Indicator: "DeleteFileA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "DeleteObject" (Indicator: "DeleteObject"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "DestroyWindow" (Indicator: "DestroyWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "DispatchMessageA" (Indicator: "DispatchMessageA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "DrawTextA" (Indicator: "DrawTextA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "EmptyClipboard" (Indicator: "EmptyClipboard"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "EnableMenuItem" (Indicator: "EnableMenuItem"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "EnableWindow" (Indicator: "EnableWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "EndPaint" (Indicator: "EndPaint"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "EnumResourceTypesA" (Indicator: "EnumResourceTypesA"; in Source: "00000000-00004160-00000C1E-74767054") Found string "EnumSystemLocalesA" (Indicator: "EnumSystemLocalesA"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "EnumSystemLocalesW" (Indicator: "EnumSystemLocalesW"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "ExitProcess" (Indicator: "ExitProcess"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "ExitWindowsEx" (Indicator: "ExitWindowsEx"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStringsA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "FillRect" (Indicator: "FillRect"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "FindClose" (Indicator: "FindClose"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "FindFirstFileA" (Indicator: "FindFirstFileA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "FindNextFileA" (Indicator: "FindNextFileA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "FindWindowExA" (Indicator: "FindWindowExA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "FlsGetValue" (Indicator: "FlsGetValue"; in Source: "00000000-00004160-00000C1E-71679106") Found string "FormatMessageA" (Indicator: "FormatMessageA"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "FormatMessageW" (Indicator: "FormatMessageW"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetACP" (Indicator: "GetACP"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetClassInfoA" (Indicator: "GetClassInfoA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetClientRect" (Indicator: "GetClientRect"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetCPInfo" (Indicator: "GetCPInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetCPInfoExW" (Indicator: "GetCPInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetDC" (Indicator: "GetDC"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetDeviceCaps" (Indicator: "GetDeviceCaps"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetDIBits" (Indicator: "GetDIBits"; in File: "AdvSplash.dll.2808196158") Found string "GetFileAttributesA" (Indicator: "GetFileAttributesA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetFileSize" (Indicator: "GetFileSize"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetFileVersionInfoA" (Indicator: "GetFileVersionInfoA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSizeA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetFullPathNameA" (Indicator: "GetFullPathNameA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetLastError" (Indicator: "GetLastError"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetMessageA" (Indicator: "GetMessageA"; in File: "AdvSplash.dll.2808196158") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetObjectA" (Indicator: "GetObjectA"; in File: "AdvSplash.dll.2808196158") Found string "GetOEMCP" (Indicator: "GetOEMCP"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetSysColor" (Indicator: "GetSysColor"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangI"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetSystemDirectoryA" (Indicator: "GetSystemDirectoryA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetSystemMenu" (Indicator: "GetSystemMenu"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetTempFileNameA" (Indicator: "GetTempFileNameA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetTempPathA" (Indicator: "GetTempPathA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetThreadLocale" (Indicator: "GetThreadLocale"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetThreadPreferredUILanguages" (Indicator: "GetThreadPreferredUILanguages"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetThreadUILanguage" (Indicator: "GetThreadUILanguage"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetTickCount" (Indicator: "GetTickCount"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetVersion" (Indicator: "GetVersion"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetWindowLongA" (Indicator: "GetWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetWindowRect" (Indicator: "GetWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GetWindowsDirectoryA" (Indicator: "GetWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GlobalFree" (Indicator: "GlobalFree"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GlobalLock" (Indicator: "GlobalLock"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "GlobalSize" (Indicator: "GlobalSize"; in File: "System.dll.3929894841") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "IdnToAscii" (Indicator: "ToAscii"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "InitiateShutdownA" (Indicator: "InitiateShutdown"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "InvalidateRect" (Indicator: "InvalidateRect"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "IsDBCSLeadByteEx" (Indicator: "IsDBCSLeadByteEx"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "IsValidCodePage" (Indicator: "IsValidCodePage"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "IsValidLocale" (Indicator: "IsValidLocale"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "IsValidLocaleName" (Indicator: "IsValidLocale"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "IsWindow" (Indicator: "IsWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "IsWindowEnabled" (Indicator: "IsWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "IsWindowVisible" (Indicator: "IsWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "kernel32.EnumSystemLocalesA" (Indicator: "EnumSystemLocalesA"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.EnumSystemLocalesW" (Indicator: "EnumSystemLocalesW"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.FormatMessageA" (Indicator: "FormatMessageA"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.FormatMessageW" (Indicator: "FormatMessageW"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetACP" (Indicator: "GetACP"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetCPInfo" (Indicator: "GetCPInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetCPInfoExW" (Indicator: "GetCPInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetLocaleInfoA" (Indicator: "GetLocaleInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetLocaleInfoW" (Indicator: "GetLocaleInfo"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetOEMCP" (Indicator: "GetOEMCP"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangI"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetThreadLocale" (Indicator: "GetThreadLocale"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetThreadPreferredUILanguages" (Indicator: "GetThreadPreferredUILanguages"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetThreadUILanguage" (Indicator: "GetThreadUILanguage"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.IdnToAscii" (Indicator: "ToAscii"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.IsDBCSLeadByteEx" (Indicator: "IsDBCSLeadByteEx"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.IsValidCodePage" (Indicator: "IsValidCodePage"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.IsValidLocale" (Indicator: "IsValidLocale"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.IsValidLocaleName" (Indicator: "IsValidLocale"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.LCMapStringA" (Indicator: "LCMapStringA"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.LCMapStringW" (Indicator: "LCMapStringW"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.LocaleNameToLCID" (Indicator: "LocaleNameToLCID"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.SetThreadLocale" (Indicator: "SetThreadLocale"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "kernel32.SetThreadPreferredUILanguages" (Indicator: "SetThreadPreferredUILanguages"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "LCMapStringA" (Indicator: "LCMapStringA"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "LCMapStringW" (Indicator: "LCMapStringW"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "LoadBitmapA" (Indicator: "LoadBitmapA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "LoadCursorA" (Indicator: "LoadCursorA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "LoadImageA" (Indicator: "LoadImageA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in File: "AdvSplash.dll.2808196158") Found string "LoadLibraryExA" (Indicator: "LoadLibraryExA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "LocaleNameToLCID" (Indicator: "LocaleNameToLCID"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValueA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "lstrcatA" (Indicator: "lstrcatA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "lstrcmpA" (Indicator: "lstrcmpA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "lstrcmpiA" (Indicator: "lstrcmpiA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "lstrcpyA" (Indicator: "lstrcpyA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "lstrcpynA" (Indicator: "lstrcpynA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "lstrlenA" (Indicator: "lstrlenA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "MoveFileA" (Indicator: "MoveFile"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "MoveFileExA" (Indicator: "MoveFile"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "MulDiv" (Indicator: "MulDiv"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "OleInitialize" (Indicator: "OleInitialize"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "OleUninitialize" (Indicator: "OleUninitialize"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "OpenClipboard" (Indicator: "OpenClipboard"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "PeekMessageA" (Indicator: "PeekMessageA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "PostMessageA" (Indicator: "PostMessageA"; in File: "AdvSplash.dll.2808196158") Found string "PostQuitMessage" (Indicator: "PostQuitMessage"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "ReadFile" (Indicator: "ReadFile"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegCreateKeyExA" (Indicator: "RegCreateKeyExA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegDeleteKeyA" (Indicator: "RegDeleteKeyA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegDeleteKeyExA" (Indicator: "RegDeleteKeyExA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegDeleteValueA" (Indicator: "RegDeleteValueA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegEnumKeyA" (Indicator: "RegEnumKeyA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegEnumValueA" (Indicator: "RegEnumValueA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegisterClassA" (Indicator: "RegisterClassA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegOpenKeyExA" (Indicator: "RegOpenKeyExA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegQueryValueExA" (Indicator: "RegQueryValueExA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RegSetValueExA" (Indicator: "RegSetValueExA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "ReleaseDC" (Indicator: "ReleaseDC"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "RemoveDirectoryA" (Indicator: "RemoveDirectoryA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "ScreenToClient" (Indicator: "ScreenToClient"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SearchPathA" (Indicator: "SearchPathA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SelectObject" (Indicator: "SelectObject"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SendMessageA" (Indicator: "SendMessageA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SendMessageTimeoutA" (Indicator: "SendMessageTimeoutA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetClassLongA" (Indicator: "SetClassLongA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetClipboardData" (Indicator: "SetClipboardData"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetCurrentDirectoryA" (Indicator: "SetCurrentDirectory"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetCursor" (Indicator: "SetCursor"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetDefaultDllDirectories" (Indicator: "SetDefaultDllDirectories"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariableA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetFileAttributesA" (Indicator: "SetFileAttributesA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetFilePointer" (Indicator: "SetFilePointer"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetFileSecurityA" (Indicator: "SetFileSecurityA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetFileTime" (Indicator: "SetFileTime"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetForegroundWindow" (Indicator: "SetForegroundWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetThreadLocale" (Indicator: "SetThreadLocale"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "SetThreadPreferredUILanguages" (Indicator: "SetThreadPreferredUILanguages"; in File: "api-ms-win-core-localization-l1-2-0.dll.3809801403") Found string "SetTimer" (Indicator: "SetTimer"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetWindowLongA" (Indicator: "SetWindowLongA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetWindowPos" (Indicator: "SetWindowPos"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SetWindowRgn" (Indicator: "SetWindowRgn"; in File: "AdvSplash.dll.2808196158") Found string "SetWindowTextA" (Indicator: "SetWindowTextA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SHBrowseForFolderA" (Indicator: "SHBrowseForFolderA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "ShellExecuteA" (Indicator: "ShellExecuteA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SHFileOperationA" (Indicator: "SHFileOperationA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SHGetFileInfoA" (Indicator: "GetFileInfo"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SHGetFolderPathA" (Indicator: "SHGetFolderPathA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SHGetPathFromIDListA" (Indicator: "SHGetPathFromIDListA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "ShowWindow" (Indicator: "ShowWindow"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "Sleep" (Indicator: "Sleep"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "SleepConditionVariableCS" (Indicator: "Sleep"; in Source: "00000000-00004160-00000C1E-72099030") Found string "StringFromGUID2" (Indicator: "StringFromGUID2"; in File: "System.dll.3929894841") Found string "SystemParametersInfoA" (Indicator: "SystemParametersInfoA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "timeSetEvent" (Indicator: "SetEvent"; in File: "AdvSplash.dll.2808196158") Found string "TrackPopupMenu" (Indicator: "TrackPopupMenu"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "UnregisterClassA" (Indicator: "UnregisterClassA"; in File: "AdvSplash.dll.2808196158") Found string "VerQueryValueA" (Indicator: "VerQueryValueA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; in Source: "00000000-00004160-00000C1E-73958943") Found string "VirtualFree" (Indicator: "VirtualFree"; in File: "System.dll.3929894841") Found string "VirtualProtect" (Indicator: "VirtualProtect"; in File: "System.dll.3929894841") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "WakeAllConditionVariable" (Indicator: "WakeAllConditionVariable"; in Source: "00000000-00004160-00000C1E-72099179") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in File: "System.dll.3929894841") Found string "WriteFile" (Indicator: "WriteFile"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "wsprintfA" (Indicator: "wsprintfA"; in File: "47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin") Found string "MulDiv" (Indicator: "MulDiv"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "DeleteFileA" (Indicator: "DeleteFileA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "FindFirstFileA" (Indicator: "FindFirstFileA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "FindNextFileA" (Indicator: "FindNextFileA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "FindClose" (Indicator: "FindClose"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetFilePointer" (Indicator: "SetFilePointer"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "MultiByteToWideChar" (Indicator: "MultiByteToWideChar"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "FreeLibrary" (Indicator: "FreeLibrary"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "LoadLibraryExA" (Indicator: "LoadLibraryExA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetModuleHandleA" (Indicator: "GetModuleHandleA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GlobalAlloc" (Indicator: "GlobalAlloc"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "GlobalFree" (Indicator: "GlobalFree"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStringsA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "lstrcmpA" (Indicator: "lstrcmpA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "lstrcmpiA" (Indicator: "lstrcmpiA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CloseHandle" (Indicator: "CloseHandle"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetFileTime" (Indicator: "SetFileTime"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SearchPathA" (Indicator: "SearchPathA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetFullPathNameA" (Indicator: "GetFullPathNameA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "MoveFileA" (Indicator: "MoveFile"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetCurrentDirectoryA" (Indicator: "SetCurrentDirectory"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetFileAttributesA" (Indicator: "GetFileAttributesA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetFileAttributesA" (Indicator: "SetFileAttributesA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "Sleep" (Indicator: "Sleep"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetTickCount" (Indicator: "GetTickCount"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetFileSize" (Indicator: "GetFileSize"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetModuleFileNameA" (Indicator: "GetModuleFileNameA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetCurrentProcess" (Indicator: "GetCurrentProcess"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CopyFileA" (Indicator: "CopyFileA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "ExitProcess" (Indicator: "ExitProcess"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetEnvironmentVariableA" (Indicator: "SetEnvironmentVariableA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetWindowsDirectoryA" (Indicator: "GetWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetTempPathA" (Indicator: "GetTempPathA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLineA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "lstrlenA" (Indicator: "lstrlenA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "GetVersion" (Indicator: "GetVersion"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetErrorMode" (Indicator: "SetErrorMode"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "lstrcpynA" (Indicator: "lstrcpynA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "GlobalUnlock" (Indicator: "GlobalUnlock"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GlobalLock" (Indicator: "GlobalLock"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CreateThread" (Indicator: "CreateThread"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetLastError" (Indicator: "GetLastError"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "CreateDirectoryA" (Indicator: "CreateDirectoryA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CreateProcessA" (Indicator: "CreateProcessA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RemoveDirectoryA" (Indicator: "RemoveDirectoryA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CreateFileA" (Indicator: "CreateFileA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetTempFileNameA" (Indicator: "GetTempFileNameA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "ReadFile" (Indicator: "ReadFile"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "WriteFile" (Indicator: "WriteFile"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "lstrcpyA" (Indicator: "lstrcpyA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "MoveFileExA" (Indicator: "MoveFile"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "lstrcatA" (Indicator: "lstrcatA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetSystemDirectoryA" (Indicator: "GetSystemDirectoryA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetProcAddress" (Indicator: "GetProcAddress"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "EndPaint" (Indicator: "EndPaint"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "DrawTextA" (Indicator: "DrawTextA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "FillRect" (Indicator: "FillRect"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetClientRect" (Indicator: "GetClientRect"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "BeginPaint" (Indicator: "BeginPaint"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "DefWindowProcA" (Indicator: "DefWindowProcA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SendMessageA" (Indicator: "SendMessageA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "InvalidateRect" (Indicator: "InvalidateRect"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "EnableWindow" (Indicator: "EnableWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "ReleaseDC" (Indicator: "ReleaseDC"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetDC" (Indicator: "GetDC"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "LoadImageA" (Indicator: "LoadImageA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetWindowLongA" (Indicator: "SetWindowLongA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "IsWindow" (Indicator: "IsWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "FindWindowExA" (Indicator: "FindWindowExA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SendMessageTimeoutA" (Indicator: "SendMessageTimeoutA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "wsprintfA" (Indicator: "wsprintfA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "ShowWindow" (Indicator: "ShowWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetForegroundWindow" (Indicator: "SetForegroundWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "PostQuitMessage" (Indicator: "PostQuitMessage"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetWindowTextA" (Indicator: "SetWindowTextA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetTimer" (Indicator: "SetTimer"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "DestroyWindow" (Indicator: "DestroyWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "ExitWindowsEx" (Indicator: "ExitWindowsEx"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CharNextA" (Indicator: "CharNextA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetClassInfoA" (Indicator: "GetClassInfoA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CreateWindowExA" (Indicator: "CreateWindowExA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SystemParametersInfoA" (Indicator: "SystemParametersInfoA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegisterClassA" (Indicator: "RegisterClassA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "ScreenToClient" (Indicator: "ScreenToClient"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetWindowRect" (Indicator: "GetWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "EnableMenuItem" (Indicator: "EnableMenuItem"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetSystemMenu" (Indicator: "GetSystemMenu"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetClassLongA" (Indicator: "SetClassLongA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "IsWindowEnabled" (Indicator: "IsWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetWindowPos" (Indicator: "SetWindowPos"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetSysColor" (Indicator: "GetSysColor"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetWindowLongA" (Indicator: "GetWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetCursor" (Indicator: "SetCursor"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "LoadCursorA" (Indicator: "LoadCursorA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "LoadBitmapA" (Indicator: "LoadBitmapA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CallWindowProcA" (Indicator: "CallWindowProcA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "IsWindowVisible" (Indicator: "IsWindow"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CloseClipboard" (Indicator: "CloseClipboard"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetClipboardData" (Indicator: "SetClipboardData"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "EmptyClipboard" (Indicator: "EmptyClipboard"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "OpenClipboard" (Indicator: "OpenClipboard"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "TrackPopupMenu" (Indicator: "TrackPopupMenu"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "AppendMenuA" (Indicator: "AppendMenuA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CreatePopupMenu" (Indicator: "CreatePopupMenu"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetSystemMetrics" (Indicator: "GetSystemMetrics"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "DispatchMessageA" (Indicator: "DispatchMessageA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "PeekMessageA" (Indicator: "PeekMessageA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SelectObject" (Indicator: "SelectObject"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CreateFontIndirectA" (Indicator: "CreateFontIndirectA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "DeleteObject" (Indicator: "DeleteObject"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "GetDeviceCaps" (Indicator: "GetDeviceCaps"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SHFileOperationA" (Indicator: "SHFileOperationA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "ShellExecuteA" (Indicator: "ShellExecuteA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SHGetFileInfoA" (Indicator: "GetFileInfo"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SHBrowseForFolderA" (Indicator: "SHBrowseForFolderA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SHGetPathFromIDListA" (Indicator: "SHGetPathFromIDListA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegEnumValueA" (Indicator: "RegEnumValueA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegEnumKeyA" (Indicator: "RegEnumKeyA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegQueryValueExA" (Indicator: "RegQueryValueExA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegSetValueExA" (Indicator: "RegSetValueExA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegCreateKeyExA" (Indicator: "RegCreateKeyExA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegCloseKey" (Indicator: "RegCloseKey"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegDeleteValueA" (Indicator: "RegDeleteValueA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegDeleteKeyA" (Indicator: "RegDeleteKeyA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "RegOpenKeyExA" (Indicator: "RegOpenKeyExA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValueA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "SetFileSecurityA" (Indicator: "SetFileSecurityA"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CoCreateInstance" (Indicator: "CoCreateInstance"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "OleUninitialize" (Indicator: "OleUninitialize"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "OleInitialize" (Indicator: "OleInitialize"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "CoTaskMemFree" (Indicator: "CoTaskMemFree"; in Source: "00000000-00004160.00000000.78740.00407000.00000002.mdmp, 00000000-00004160.00000001.80663.00407000.00000002.mdmp, 00000000-00004160.00000002.82577.00407000.00000002.mdmp") Found string "VerQueryValueA" (Indicator: "VerQueryValueA"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "GetFileVersionInfoA" (Indicator: "GetFileVersionInfoA"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSizeA"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "SHGetFolderPathA" (Indicator: "SHGetFolderPathA"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "InitiateShutdownA" (Indicator: "InitiateShutdown"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "RegDeleteKeyExA" (Indicator: "RegDeleteKeyExA"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "SetDefaultDllDirectories" (Indicator: "SetDefaultDllDirectories"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "GlobalSize" (Indicator: "GlobalSize"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "VirtualFree" (Indicator: "VirtualFree"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "LoadLibraryA" (Indicator: "LoadLibraryA"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "WideCharToMultiByte" (Indicator: "WideCharToMultiByte"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "VirtualAlloc" (Indicator: "VirtualAlloc"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "VirtualProtect" (Indicator: "VirtualProtect"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "CLSIDFromString" (Indicator: "CLSIDFromString"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "StringFromGUID2" (Indicator: "StringFromGUID2"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.10003000.00000002.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.10003000.00000002.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.10003000.00000002.mdmp") Found string "VirtualQuery failed for %d bytes at address %p" (Indicator: "VirtualQuery"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "VirtualProtect failed with code 0x%x" (Indicator: "VirtualProtect"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp") Found string "erNEL32::EnumResourceTypesA(i 0,i R3 ,i 0)" (Indicator: "EnumResourceTypesA"; in Source: "00000000-00004160.00000000.78740.00409000.00000004.mdmp, 00000000-00004160.00000000.78740.00436000.00000004.mdmp, 00000000-00004160.00000001.80663.00409000.00000004.mdmp, 00000000-00004160.00000001.80663.00436000.00000004.mdmp, 00000000-00004160.00000002.82577.00409000.00000004.mdmp, 00000000-00004160.00000002.82577.00436000.00000004.mdmp") Found string "EnumResourceTypesA" (Indicator: "EnumResourceTypesA"; in Source: "00000000-00004160.00000000.78740.03140000.00000004.mdmp, 00000000-00004160.00000001.80663.03140000.00000004.mdmp, 00000000-00004160.00000002.82577.03140000.00000004.mdmp") Found string "69282973668,3916,103,,GetAsyncKeyState,user32.dll,"00:20:54.546",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; in Source: "00000000-00004160.00000001.80663.03140000.00000004.mdmp") Found string "151767937370,3916,103,,GetAsyncKeyState,user32.dll,"00:21:28.921",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; in Source: "00000000-00004160.00000002.82577.03140000.00000004.mdmp")2b:T4c5,"image001.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73b90000 "image001.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73190000 "image001.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 6f440000 "image001.exe" loaded module "KERNEL32.DLL" at base 74f50000 "image001.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735c0000 "image001.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 6f170000 "image001.exe" loaded module "COMCTL32.DLL" at base 6f240000 "image001.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74240000 "image001.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74020000 "image001.exe" loaded module "%TEMP%\NSRB7D0.TMP\ADVSPLASH.DLL" at base 10000000 "image001.exe" loaded module "USER32" at base 74560000 "image001.exe" loaded module "%TEMP%\NSRB7D0.TMP\SYSTEM.DLL" at base 10000000 "image001.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74560000 "image001.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74560000 "image001.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74920000 "image001.exe" loaded module "COMCTL32" at base 6ec100002c:T968,"47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin" file has an entrypoint instructions - "sub esp, 0x184,push ebx,push esi,push edi,xor ebx, ebx,push 0x8001,mov dword ptr [esp + 0x18], ebx,mov dword ptr [esp + 0x10], 0x409198,mov dword ptr [esp + 0x20], ebx,mov byte ptr [esp + 0x14], 0x20,call dword ptr [0x4070a8],call dword ptr [0x4070a4],cmp ax, 6,je 0x4031b5,push ebx,call 0x406126,cmp eax, ebx,je 0x4031b5,push 0xc00,call eax,mov esi, 0x407298,push esi,call 0x4060b8,push esi,call dword ptr [0x4070a0],lea esi, [esi + eax + 1],cmp byte ptr [esi], bl,jne 0x4031ba,push ebp," "libenchant-2.dll" file has an entrypoint instructions - "mov rax, qword ptr [rip + 0x8899],mov dword ptr [rax], 0,jmp 0x256101200,nop word ptr cs:[rax + rax],nop dword ptr [rax],mov rdx, rcx,lea rcx, [rip + 0xbc86],jmp 0x256107380,nop ,lea rcx, [rip + 9],jmp 0x256101370,nop dword ptr [rax],ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push r14,push r13,push r12,push rsi,push rbx,sub rsp, 0x20,xor r14d, r14d,mov r13, rdx," "AdvSplash.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10003060], eax,xor eax, eax,inc eax,ret 0xc,mov ecx, dword ptr [0x1000306c],push esi,mov esi, dword ptr [0x10003070],or eax, 0xffffffff,push edi,mov edi, dword ptr [0x10003068],sub ecx, 0,je 0x10001196,dec ecx,je 0x100011bf,dec ecx,je 0x100011d4,jmp 0x10001229,mov edx, dword ptr [0x10003074],test edx, edx,jne 0x100011fb,mov ecx, dword ptr [0x100030a0],mov dword ptr [0x1000306c], 1,test esi, esi,mov dword ptr [0x10003074], ecx,je 0x100011bf,mov eax, 0xff," "api-ms-win-core-localization-l1-2-0.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "System.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],cmp dword ptr [esp + 8], 1,mov dword ptr [0x10004038], eax,jne 0x1000275b,push 0x1000403c,push 0x40,push 4,push 0x1000404c,call dword ptr [0x10003038],xor eax, eax,mov byte ptr [0x1000404c], 0xc2,mov dword ptr [0x1000403c], eax,mov dword ptr [0x10004044], eax,mov dword ptr [0x10004058], eax,mov dword ptr [0x10004048], eax,mov dword ptr [0x10004040], eax,mov dword ptr [0x10004050], eax,mov byte ptr [0x1000404e], al,xor eax, eax,inc eax,ret 0xc,mov eax, 0x10000,ret ,mov eax, dword ptr [esp + 4],"2d:Tc84,"System.Numerics.Vectors.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens\Sollyset\Fungerende\System.Numerics.Vectors.dll]- [targetUID: 00000000-00004160] "libenchant-2.dll" has type "PE32+ executable (DLL) (console) x86-64 (stripped to external PDB) for MS Windows"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Omgrelsen\Bundpriss\Potensfunktioners\libenchant-2.dll]- [targetUID: 00000000-00004160] "AdvSplash.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsrB7D0.tmp\AdvSplash.dll]- [targetUID: 00000000-00004160] "api-ms-win-core-localization-l1-2-0.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens\Sollyset\Fungerende\api-ms-win-core-localization-l1-2-0.dll]- [targetUID: 00000000-00004160] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsrB7D0.tmp\System.dll]- [targetUID: 00000000-00004160] "face-surprise.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Mamma\Fjendskes\Rewrought38\Jetpiloters\face-surprise.png]- [targetUID: 00000000-00004160] "OrderNow.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\OrderNow.html]- [targetUID: 00000000-00004160] "media-zip-symbolic.symbolic.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Omgrelsen\Bundpriss\Potensfunktioners\media-zip-symbolic.symbolic.png]- [targetUID: 00000000-00004160] "image-loading.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Omgrelsen\Bundpriss\Potensfunktioners\image-loading.png]- [targetUID: 00000000-00004160] "Giraf188.Opk" has type "ASCII text with very long lines with no line terminators"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Giraf188.Opk]- [targetUID: 00000000-00004160] "semi-starred-symbolic.symbolic.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\semi-starred-symbolic.symbolic.png]- [targetUID: 00000000-00004160] "Hyldetrernes.til" has type "data"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Hyldetrernes.til]- [targetUID: 00000000-00004160] "star-new-symbolic.symbolic.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\star-new-symbolic.symbolic.png]- [targetUID: 00000000-00004160] "libxml2-2.0.typelib" has type "HTML document ASCII text with CRLF line terminators"- Location: [%USERPROFILE%\Administrationsgrundlag\Handlingsreferater\Omgrelsen\Bundpriss\Potensfunktioners\libxml2-2.0.typelib]- [targetUID: 00000000-00004160]2e:T7ec,"image001.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "image001.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "image001.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsrB7D0.tmp\ADVSPLASH.DLL" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsrB7D0.tmp\AdvSplash.dll" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsrB7D0.tmp\WINMM.DLL" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsrB7D0.tmp\WINMM.dll" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsrB7D0.tmp\WINMMBASE.DLL" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsrB7D0.tmp\WINMMBASE.dll" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens\Sollyset\Fungerende\SYSTEM.NUMERICS.VECTORS.DLL" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens\Sollyset\Fungerende\System.Numerics.Vectors.dll" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens\Sollyset\Fungerende\API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Tilsynsmyndighedens\Sollyset\Fungerende\api-ms-win-core-localization-l1-2-0.dll" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Omgrelsen\Bundpriss\Potensfunktioners\LIBENCHANT-2.DLL" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Omgrelsen\Bundpriss\Potensfunktioners\libenchant-2.dll"2f:T5f9,"image001.exe" trying to access non-existent file "C:\IMAGE001.EXE.LOCAL" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\HYLDETRERNES.TIL" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Hyldetrernes.til" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\ORDERNOW.HTML" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\OrderNow.html" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\GIRAF188.OPK" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Giraf188.Opk" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Mamma\Fjendskes\Rewrought38\Jetpiloters\FACE-SURPRISE.PNG" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Mamma\Fjendskes\Rewrought38\Jetpiloters\face-surprise.png" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Omgrelsen\Bundpriss\Potensfunktioners\IMAGE-LOADING.PNG" "image001.exe" trying to access non-existent file "C:\Users\%OSUSER%\Administrationsgrundlag\Handlingsreferater\Omgrelsen\Bundpriss\Potensfunktioners\image-loading.png"30:T1264,Observed string: " Order Hex Workshop Now

Order Hex Workshop Now

Thank you for your interest in Hex Workshop Hex Editor. We welcome you to join thousands of other satisfied BreakPoint Software customers by ordering Hex Workshop now. Purchasing Hex Workshop entitles you to uninterrupted usage of the premier Windows Hex Editor and all upgrades for 1 year (maintenance period).

Pricing:

User Licenses	Cost (USD)
Single	$89.95*
2 to 5	$84.95
6 to 10	$79.95
11 to 50	$74.95
Unlimited**	$4,000.00

Prices are guaranteed until December 31, 2009 and are applicable to Hex Workshop version 6 or lower.

* Educational discounts are also available. Please visit http://www.hexworkshop.com/ordering/ for instructions and ordering links.

** Unlimited site licenses are restricted to a single physical location or campus. Please email sales@bpsoft.com with any questions regarding eligibility.

Online Ordering:

Hex Workshop may be ordered online Your unlocking key will be emailed to you within 48 hours of purchase. Please contact sales@bpsoft.com with any sales related questions.

Other Ordering Methods:

You may also purchase Hex Workshop by Phone, Check, Money Order, Fax, Purchase Order, Wire Transfer, EFT and PayPal. Please see http://www.hexworkshop.com/ordering for instructions, requirements, and limitations. Additional fees may apply.

" (Indicator: ""copy") in Source: OrderNow.html Observed string: "

Copyright 1999-2009 BreakPoint Software, Inc. All" (Indicator: ""copy") in Source: OrderNow.html Observed string: "Copy" (Indicator: "copy") in Source: 00000000-00004160.00000000.78740.00409000.00000004.mdmp 00000000-00004160.00000000.78740.10003000.00000002.mdmp 00000000-00004160.00000001.80663.00409000.00000004.mdmp 00000000-00004160.00000001.80663.10003000.00000002.mdmp 00000000-00004160.00000002.82577.00409000.00000004.mdmp 00000000-00004160.00000002.82577.10003000.00000002.mdmp31:T531,Pattern match: "https://github.com/dotnet/runtime" Heuristic match: "4>1T:.Zm" Pattern match: "http://www.hexworkshop.com/ordering/" Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd" Pattern match: "http://www.bpsoft.com/" Pattern match: "http://www.hexworkshop.com/" Pattern match: "http://www.sipworkbench.com/" Pattern match: "http://www.w3.org/1999/xhtml" Heuristic match: "e:http://www.hexworkshop.com/ordering\" (Indicator: \"paypal\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"RepositoryUrl!https://github.com/dotnet/runtime\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"image001.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 6F170000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"image001.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74410000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"Loads the cryptographic module DLL","description":"\"image001.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74B80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"image001.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"image001.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"image001.exe\" touched \"Property System Both Class Factory\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"api-ms-win-core-localization-l1-2-0.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","relevance":1,"id":"static-146","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\" has an executable section named \".text\"\n \"libenchant-2.dll\" has an executable section named \".text\"\n \"AdvSplash.dll\" has an executable section named \".text\"\n \"api-ms-win-core-localization-l1-2-0.dll\" has an executable section named \".text\"\n \"System.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\" has an writable section named \".data\"\n \"47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\" has an writable section named \".ndata\"\n \"libenchant-2.dll\" has an writable section named \".data\"\n \"libenchant-2.dll\" has an writable section named \".bss\"\n \"libenchant-2.dll\" has an writable section named \".idata\"\n \"libenchant-2.dll\" has an writable section named \".CRT\"\n \"libenchant-2.dll\" has an writable section named \".tls\"\n \"libenchant-2.dll\" has an writable section named \".rsrc\"\n \"AdvSplash.dll\" has an writable section named \".data\"\n \"System.dll\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2c","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"libenchant-2.dll\" has high imagebase \"0x256100000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"image001.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"image001.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"image001.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"image001.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"image001.exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: AdvSplash.dll.2808196158\n Observed string: \"LoadLibraryExA\" (Indicator: \"LoadLibrary\") in Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\n Observed string: \"LoadLibraryExA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp\n Observed string: \"LoadLibraryA\" (Indicator: \"LoadLibrary\") in Source: 00000000-00004160.00000000.78740.00409000.00000004.mdmp\n 00000000-00004160.00000000.78740.10003000.00000002.mdmp\n 00000000-00004160.00000001.80663.00409000.00000004.mdmp\n 00000000-00004160.00000001.80663.10003000.00000002.mdmp\n 00000000-00004160.00000002.82577.00409000.00000004.mdmp\n 00000000-00004160.00000002.82577.10003000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"image001.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"image001.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\RUFICARPOUS\\FINANSIERENDES\\MARCHITE\\HOUSEFATHER.INI\"\n \"image001.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"image001.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\RUFICARPOUS\\FINANSIERENDES\\MARCHITE\\HOUSEFATHER.INI\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"$30","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$31","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"RepositoryUrl!https://github.com/dotnet/runtime\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00004160\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed string:\"SystemParametersInfoA\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"SystemParametersInfoA\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"image001.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00004160)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"image001.exe\" called \"FindFirstFileA\" with parameter %USERPROFILE%\\Documents\\Excerpts194\\Sulfuretted\\Malaga\\Brugtbaads.Con (UID: 00000000-00004160)\n \"image001.exe\" called \"FindFirstFileA\" with parameter %APPDATA%\\Scenarietekniks\\Skaanselsls\\Hammered\\Subproblem.smo (UID: 00000000-00004160)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Observed string:\"OpenClipboard\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"OpenClipboard\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed string:\"FindFirstFileA\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"FindNextFileA\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"FindFirstFileA\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]\n Observed string:\"FindNextFileA\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read registry keys (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\n Observed string: \"GetProcAddress\" (Indicator: \"GetProcAddress\") in Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000000.78740.00409000.00000004.mdmp\n 00000000-00004160.00000000.78740.10003000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00409000.00000004.mdmp\n 00000000-00004160.00000001.80663.10003000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00409000.00000004.mdmp\n 00000000-00004160.00000002.82577.10003000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Observed string:\"69282973668,3916,103,,GetAsyncKeyState,user32.dll,\"00:20:54.546\",RX=0,PX=0\" [Source: 00000000-00004160.00000001.80663.03140000.00000004.mdmp]\n Observed string:\"151767937370,3916,103,,GetAsyncKeyState,user32.dll,\"00:21:28.921\",RX=0,PX=0\" [Source: 00000000-00004160.00000002.82577.03140000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed string:\"ExpandEnvironmentStringsA\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"ExpandEnvironmentStringsA\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed string:\"GetModuleFileName\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"GetModuleFileName\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed string:\"GetSystemMetrics\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"GetSystemMetrics\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\n Observed string: \"GetTickCount\" (Indicator: \"GetTickCount\") in Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Antiattrition\\Colorblindness\\Infantility\\Bestillingsmulighed\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00004160.00000000.78740.03140000.00000004.mdmp\n 00000000-00004160.00000001.80663.03140000.00000004.mdmp\n 00000000-00004160.00000002.82577.03140000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Indtjente\\Woehlerite\\Staldbroderens\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00004160.00000000.78740.03140000.00000004.mdmp\n 00000000-00004160.00000001.80663.03140000.00000004.mdmp\n 00000000-00004160.00000002.82577.03140000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files (API string)","description":"Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\n Observed string: \"DeleteFileA\" (Indicator: \"DeleteFileA\") in Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry value (API string)","description":"Observed string: \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\") in Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\n Observed string: \"RegDeleteValueA\" (Indicator: \"RegDeleteValue\") in Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Observed string:\"AdjustTokenPrivileges\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"SeShutdownPrivilege\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"AdjustTokenPrivileges\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]\n Observed string:\"SeShutdownPrivilege\" [Source: 00000000-00004160.00000000.78740.00409000.00000004.mdmp\n 00000000-00004160.00000001.80663.00409000.00000004.mdmp\n 00000000-00004160.00000002.82577.00409000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin\n Observed string: \"ExitProcess\" (Indicator: \"ExitProcess\") in Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Observed string:\"ExitWindowsEx\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"InitiateShutdownA\" [Source: 47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34.bin]\n Observed string:\"ExitWindowsEx\" [Source: 00000000-00004160.00000000.78740.00407000.00000002.mdmp\n 00000000-00004160.00000001.80663.00407000.00000002.mdmp\n 00000000-00004160.00000002.82577.00407000.00000002.mdmp]\n Observed string:\"InitiateShutdownA\" [Source: 00000000-00004160.00000000.78740.00409000.00000004.mdmp\n 00000000-00004160.00000001.80663.00409000.00000004.mdmp\n 00000000-00004160.00000002.82577.00409000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"AdvSplash.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsrB7D0.tmp\\AdvSplash.dll]- [targetUID: 00000000-00004160]\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsrB7D0.tmp\\System.dll]- [targetUID: 00000000-00004160]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"AdvSplash.dll\" was detected as \"Armadillo v4.x\"\n \"api-ms-win-core-localization-l1-2-0.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data\n .CRT\n .data\n .data with unusual entropies 0.706483796146\n 0.246893091457\n 0.783754194555\n 0.349885353835","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00004160-41967-1-0040316D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"36/69 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"image001.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"image001.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"image001.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"image001.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"image001.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"image001.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"image001.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$34","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$35","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.0.0.0\" found in string \"Nullsoft.NSIS.exehead,processorArchitecture=\"*\",type=\"win32\",version=\"1.0.0.0\"C:\\image001.exe\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"api-ms-win-base-bootconfig-l1-1-0\" (Indicator: \"bootconfig\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"image001.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsvB6B5.tmp\" for deletion\n \"image001.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsrB7D0.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"image001.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsvB6B5.tmp\" with delete access\n \"image001.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsrB7D0.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueA@ADVAPI32.DLL at 00000000-00004160-41967-1-0040316D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"libenchant-2.dll\" claimed CRC 85893 while the actual is CRC 427952\n \"api-ms-win-core-localization-l1-2-0.dll\" claimed CRC 84028 while the actual is CRC 52185","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n OpenProcessToken\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n GetSystemDirectoryA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA\n VirtualProtect\n LoadLibraryA\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$37","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"libenchant-2.dll\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"36/69 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00004160-41967-1-0040316D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":21,"files_deleted_count":0,"registry_keys_created_count":23,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["adwind","agenttesla","backdoor","banker","botnet","coinminer","darkcomet","gozi","isfb","lokibot","mirai","nitol","papras","rat","spambot","tofsee","trojan","ursnif"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"641d9a1ff3f94b9d7e04a1e8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"image001.exe","analysis_start_time":"2023-03-24T12:40:00+00:00","indicators_count":{"informative":87,"suspicious":30,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}],"processes":[{"pid":4160,"ppid":0,"name":"image001.exe","command_line":"","sha256":"47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34","normalized_path":"C:\\image001.exe","uid":"00000000-00004160","icon":"$38"}],"all_imported_dlls":["win32u.dll","powrprof.dll","WinTypes.dll","kernel.appcore.dll","ole32.dll","msctf.dll","CoreMessaging.dll","wow64cpu.dll","ntdll.dll","cryptbase.dll","uxtheme.dll","oleaccrc.dll","kernel32.dll","msvcp_win.dll","ucrtbase.dll","shell32.dll","userenv.dll","SHCore.dll","shlwapi.dll","imm32.dll","propsys.dll","oleacc.dll","wow64win.dll","oleaut32.dll","dwmapi.dll","usp10.dll","System.dll","wow64.dll","user32.dll","apphelp.dll","winmm.dll","clbcatq.dll","riched20.dll","ws2_32.dll","KernelBase.dll","advapi32.dll","fltLib.dll","msls31.dll","sechost.dll","combase.dll","sspicli.dll","shfolder.dll","gdi32.dll","msvcrt.dll","bcryptprimitives.dll","version.dll","CoreUIComponents.dll","windows.storage.dll","profapi.dll","TextInputFramework.dll","gdi32full.dll","rpcrt4.dll","setupapi.dll","winmmbase.dll","cfgmgr32.dll","comctl32.dll","ntmarta.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AdvSplash.dll","sha256":"9bf33690090655e91389469beb5dbdd45942192f2e2486c9fa82fa6d74a0f88b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"System.dll","sha256":"fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"libenchant-2.dll","sha256":"caa457ef4bd84476790d215ffff048deb162cabc14db3ff679795ccea8972411","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"System.Numerics.Vectors.dll","sha256":"c08aa140cbf3076cbc279131ff0d294af100e44b014d7bc84e2abc3603fd09ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"api-ms-win-core-localization-l1-2-0.dll","sha256":"a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"Giraf188.Opk","sha256":"ced0e3ac5a0831fb9cbd744275f0adc443f1a98efb0d11f593f8b9354875b048","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"Hyldetrernes.til","sha256":"a0844f6bfdd96272371bda61d8a3a8ade080203c21e918935241fc178cbbb17e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"face-surprise.png","sha256":"2e28a19fde8cd74f5b5210f64044d27dac960f44157f109121f3bb2befeddc53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"image-loading.png","sha256":"d0a243627b3b346b0f888bf90db8603eaceb81ceed149fd3f8ad70dc5b5622c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"libxml2-2.0.typelib","sha256":"dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"media-zip-symbolic.symbolic.png","sha256":"2124d2887e7c271182628f31bccdded0cfd4e9aac9e3399d9eac684c8da92140","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"OrderNow.html","sha256":"b2359683890a670e8a29bd9b247a3ded89c23ceeabacc88c60117256824d35af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"semi-starred-symbolic.symbolic.png","sha256":"3396fa1974b57e543f2697ac2eb9b3971486c31f37bf10edcaa73fb9a133dac6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"star-new-symbolic.symbolic.png","sha256":"fe4cba8c30a987f1ce24e8d12bdd573a6f5e7adeb675ad0cdc8f9d4a3895703f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\OrderNow.html","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\Tilsynsmyndighedens\\Sollyset\\Fungerende\\System.Numerics.Vectors.dll","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\Tilsynsmyndighedens\\Sollyset\\Fungerende\\api-ms-win-core-localization-l1-2-0.dll","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\Mamma\\Fjendskes\\Rewrought38\\Jetpiloters\\face-surprise.png","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\Omgrelsen\\Bundpriss\\Potensfunktioners\\image-loading.png","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\Omgrelsen\\Bundpriss\\Potensfunktioners\\libenchant-2.dll","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\Omgrelsen\\Bundpriss\\Potensfunktioners\\libxml2-2.0.typelib","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\Omgrelsen\\Bundpriss\\Potensfunktioners\\media-zip-symbolic.symbolic.png","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\semi-starred-symbolic.symbolic.png","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\star-new-symbolic.symbolic.png","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\RUFICARPOUS\\FINANSIERENDES\\MARCHITE\\HOUSEFATHER.INI","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%USERPROFILE%\\Administrationsgrundlag\\Handlingsreferater\\Hyldetrernes.til","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"path":"%TEMP%\\nsrB7D0.tmp\\SUCKED\\UNISOLATIVE\\SUPERLUCKY.INI","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\INSTALLDIR32\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\INDTJENTE\\WOEHLERITE\\STALDBRODERENS\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\INDTJENTE\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\INDTJENTE\\WOEHLERITE\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\SEPTIMENS\\MATEMATIKKERNE\\DELTARYTME\\HOMOPHONOUS\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\SEPTIMENS\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\SEPTIMENS\\MATEMATIKKERNE\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\SEPTIMENS\\MATEMATIKKERNE\\DELTARYTME\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKCUHKCU\\SOFTWARE\\LIGKISTERNE106\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ISOLATORERNES\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\NONLACTESCENT\\ADELSSTANDERS\\UDGIVELSESAARETS\\ESTIMSPR\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\NONLACTESCENT\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\NONLACTESCENT\\ADELSSTANDERS\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\NONLACTESCENT\\ADELSSTANDERS\\UDGIVELSESAARETS\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ANTIATTRITION\\COLORBLINDNESS\\INFANTILITY\\BESTILLINGSMULIGHED\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ANTIATTRITION\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ANTIATTRITION\\COLORBLINDNESS\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ANTIATTRITION\\COLORBLINDNESS\\INFANTILITY\\","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:4160:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]},{"name":"SM0:4160:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"641d9a1ff3f94b9d7e04a1e8"}]}]}},"report_ids":{"sandbox_job_ids":["641d9a1ff3f94b9d7e04a1e8"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 47e8a43a5dfc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 47e8a43a5dfc…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 47e8a43a5dfc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 47e8a43a5dfc…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/47e8a43a5dfcefe4d6850764bb413ffeab6724be3a37620853b686c9fb23db34"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 47e8a43a5dfc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 47e8a43a5dfc…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]