26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 841bd3307cb1… — Score 81/100 — Hybrid Analysis","description":"Malicious verdict for sample 841bd3307cb1…. Malware family: Win/malicious_confidence_100%. Threat score 81/100. 9/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e"],"about":{"@type":"SoftwareApplication","name":"841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin","applicationCategory":["peexe","executable"],"identifier":"841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e","additionalType":"Malicious sample"},"threatScore":81,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":9,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7d7,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007208.00000000.105366.00401000.00000020.mdmp, 00000000-00007208.00000000.105366.0045F000.00000004.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp")28:T7a4,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp")29:T526,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp, 00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp")2a:T909,Assembly shows XOR instruction xor bh byte ptr [edx] in Stream UID: 15935-605-00406E88 Assembly shows XOR instruction xor eax 35760006h in Stream UID: 15935-704-004069A8 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 15935-707-00406B80 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 15935-711-00406B90 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 15935-730-00406AF8 Assembly shows XOR instruction xor al B7h in Stream UID: 15935-830-0042B700 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 15935-830-0042B700 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 15935-833-00406978 Assembly shows XOR instruction xor byte ptr [3D400006h] bh in Stream UID: 15935-845-00406D08 Assembly shows XOR instruction xor byte ptr [esi+eax] 00h in Stream UID: 15935-877-00406A00 Assembly shows XOR instruction xor al 06h in Stream UID: 15935-887-00406A10 Assembly shows XOR instruction xor al 06h in Stream UID: 15935-888-00406A08 Assembly shows XOR instruction xor eax 00000006h in Stream UID: 15935-892-00406998 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 15935-896-00406A80 Assembly shows XOR instruction xor ch byte ptr [edi] in Stream UID: 15935-1319-004067D8 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 15935-1613-00406760 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 15935-1764-00406758 Assembly shows XOR instruction xor dword ptr fs:[esi] eax in Stream UID: 15935-1782-00406B78 Assembly shows XOR instruction xor eax 35600006h in Stream UID: 15935-1786-004069B0 Assembly shows XOR instruction xor byte ptr [ebx] dh in Stream UID: 15935-1789-00406A90 Assembly shows XOR instruction xor byte ptr [35460006h] dh in Stream UID: 15935-1790-004069B8 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 15935-1792-00406B10 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 15935-1794-00406AF0 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 15935-1800-00406A68 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 15935-1853-00406A70 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 15935-1869-00406B602b:T1088,Found XOR loop in file "sample.bin" at offset 363644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 409737; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 414495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 417903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 425493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 427611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 487170; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 505468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 505696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 507392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 526656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 618678; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 403549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 405397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 592128; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 603940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 180056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 182541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 323026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 323420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 407592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 409698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 414846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 421612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 425454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 427572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 683333; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 686413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 687441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 688469; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 689497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 689821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 690525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 692069; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 693097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 693609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 694121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 694633; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 695145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 695657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 696169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 696681; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 697193; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 697705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 698217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 698729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 699241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 699753; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 700265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 700777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 701289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 722249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 723441; code bytes = 80302c:T4f8,Found system information discovery API: "GetSystemInfo" in file "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin" Found system information discovery API: "GetMonitorInfoA" in file "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin" Found system information discovery API: "GetMonitorInfo" in file "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin" Found system information discovery API: "GetMonitorInfoW" in file "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin" Found system information discovery API: "GetMonitorInfoA" in "00000000-00007208.00000000.105366.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfo" in "00000000-00007208.00000000.105366.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00007208.00000000.105366.00401000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00007208.00000000.105366.0045F000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp"2d:T506,Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007208.00000000.105366.028F0000.00000004.mdmp")2e:T4f8,"" (Indicator: "GetDC"; Source: "00000000-00007208.00000000.105366.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007208.00000000.105366.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007208.00000000.105366.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007208.00000000.105366.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007208.00000000.105366.028F0000.00000004.mdmp")3c:T908,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp, 00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp")3d:T7a4,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp, 00000000-00007208.00000000.105366.04450000.00000040.mdmp, 00000000-00007208.00000000.105366.045E0000.00000040.mdmp, 00000000-00007208.00000000.105366.04620000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007208.00000000.105366.0045F000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00007208.00000000.105366.045E0000.00000040.mdmp")3e:Te01,Found string "GetLongPathNameA" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExA" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromDate" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromBool" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: OLEAUT32.DLL) Found string "GetMonitorInfoA" (Source: 841bd3307cb1a34c5f6a907217bd09c5e4d9e7500e2863a8cd956793014d5f2e.bin, API is part of module: USER32.DLL)3f:T6d2,GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-886-0040CBB8 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-889-00406E20 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1529-00422144 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1629-00427E58 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1630-00427EE0 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1632-00428008 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1633-004280A0 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1635-00428174 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1636-00428248 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1637-0042831C GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1707-0042C180 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1770-0043BF28 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1911-004510B4 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-1912-00454210 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2000-0043B514 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2013-004510C0 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2014-004510CC GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2015-004510E4 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2016-004510D8 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2100-00451104 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2119-00452274 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2141-0043EE6C GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2143-0043EE50 GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2308-0044AC4C GetSystemMetrics@USER32.DLL at 00000000-00007208-16993-2328-0044BEC040:T425,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007208.00000000.105366.028F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6978cb56ea29fe6bcf0fa28b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007208.00000000.105366.045E0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6978cb56ea29fe6bcf0fa28b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007208.00000000.105366.04450000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007208.00000000.105366.045E0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007208.00000000.105366.04620000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6978cb56ea29fe6bcf0fa28b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6978cb56ea29fe6bcf0fa28b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"