26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 826cc552fff0… — Score 79/100 — Hybrid Analysis","description":"Malicious verdict for sample 826cc552fff0…. Malware family: Win/malicious_confidence_100%. Threat score 79/100. 6/27 AV engines flagged this file. 2 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39"],"about":{"@type":"SoftwareApplication","name":"826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin","applicationCategory":["peexe","executable"],"identifier":"826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39","additionalType":"Malicious sample"},"threatScore":79,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7d7,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005112.00000000.158485.00401000.00000020.mdmp, 00000000-00005112.00000000.158485.0045F000.00000004.mdmp, 00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp, 00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp")28:T7a4,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp")29:T526,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp, 00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp, 00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp")2a:T909,Assembly shows XOR instruction xor bh byte ptr [edx] in Stream UID: 33772-605-00406E88 Assembly shows XOR instruction xor eax 35760006h in Stream UID: 33772-704-004069A8 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 33772-707-00406B80 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 33772-711-00406B90 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 33772-730-00406AF8 Assembly shows XOR instruction xor al B7h in Stream UID: 33772-830-0042B700 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 33772-830-0042B700 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 33772-833-00406978 Assembly shows XOR instruction xor byte ptr [3D400006h] bh in Stream UID: 33772-845-00406D08 Assembly shows XOR instruction xor byte ptr [esi+eax] 00h in Stream UID: 33772-877-00406A00 Assembly shows XOR instruction xor al 06h in Stream UID: 33772-887-00406A10 Assembly shows XOR instruction xor al 06h in Stream UID: 33772-888-00406A08 Assembly shows XOR instruction xor eax 00000006h in Stream UID: 33772-892-00406998 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 33772-896-00406A80 Assembly shows XOR instruction xor ch byte ptr [edi] in Stream UID: 33772-1319-004067D8 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 33772-1613-00406760 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 33772-1764-00406758 Assembly shows XOR instruction xor dword ptr fs:[esi] eax in Stream UID: 33772-1782-00406B78 Assembly shows XOR instruction xor eax 35600006h in Stream UID: 33772-1786-004069B0 Assembly shows XOR instruction xor byte ptr [ebx] dh in Stream UID: 33772-1789-00406A90 Assembly shows XOR instruction xor byte ptr [35460006h] dh in Stream UID: 33772-1790-004069B8 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 33772-1792-00406B10 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 33772-1794-00406AF0 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 33772-1800-00406A68 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 33772-1853-00406A70 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 33772-1869-00406B602b:Tf1b,Found XOR loop in file "sample.bin" at offset 363644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 409737; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 414495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 417903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 425493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 427611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 569108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 403549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 405397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 594548; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 180056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 182541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 323026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 323420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 407592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 409698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 414846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 421612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 425454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 427572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 515905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 655161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 658241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 659269; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 661325; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 661649; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 662353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 663897; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 664925; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 665437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 665949; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 666461; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 666973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 667485; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 667997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 668509; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 669021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 669533; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 670045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 670557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 671069; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 671581; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 672093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 672605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 673117; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 694077; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 695269; code bytes = 80302c:T4f8,Found system information discovery API: "GetSystemInfo" in file "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin" Found system information discovery API: "GetMonitorInfoA" in file "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin" Found system information discovery API: "GetMonitorInfo" in file "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin" Found system information discovery API: "GetMonitorInfoW" in file "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin" Found system information discovery API: "GetMonitorInfoA" in "00000000-00005112.00000000.158485.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfo" in "00000000-00005112.00000000.158485.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00005112.00000000.158485.00401000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005112.00000000.158485.0045F000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp"2d:T506,Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005112.00000000.158485.02B40000.00000004.mdmp")2e:T4f8,"" (Indicator: "GetDC"; Source: "00000000-00005112.00000000.158485.02B40000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005112.00000000.158485.02B40000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005112.00000000.158485.02B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005112.00000000.158485.02B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005112.00000000.158485.02B40000.00000004.mdmp")3c:T908,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp, 00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp, 00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp")3d:T7a4,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp, 00000000-00005112.00000000.158485.04840000.00000040.mdmp, 00000000-00005112.00000000.158485.04980000.00000040.mdmp, 00000000-00005112.00000000.158485.049B0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005112.00000000.158485.0045F000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00005112.00000000.158485.04840000.00000040.mdmp")3e:Te01,Found string "GetLongPathNameA" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExA" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromDate" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromBool" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: OLEAUT32.DLL) Found string "GetMonitorInfoA" (Source: 826cc552fff0c40d89a46a1e8c90e07180d6399cfa807fa5b9c9d6bb3c00af39.bin, API is part of module: USER32.DLL)3f:T6d3,GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-854-0040CBB8 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1493-00422144 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1591-00427EE0 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1593-00428008 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1594-004280A0 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1595-00428174 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1596-00428248 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1597-0042831C GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1665-0042C180 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1718-0043BF28 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1841-004510B4 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1842-00454210 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1920-0043B514 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1931-004510C0 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1932-004510CC GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1933-004510E4 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-1934-004510D8 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-2016-00451104 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-2033-00452274 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-2048-0043EE6C GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-2050-0043EE50 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-2198-0044AC4C GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-2217-0044BEC0 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-2290-004510A8 GetSystemMetrics@USER32.DLL at 00000000-00005112-34877-2337-0045184840:T425,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005112.00000000.158485.02B40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6978643c4eaa63c1cf084242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005112.00000000.158485.04840000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6978643c4eaa63c1cf084242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005112.00000000.158485.04840000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005112.00000000.158485.04980000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005112.00000000.158485.049B0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6978643c4eaa63c1cf084242"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6978643c4eaa63c1cf084242"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"