24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample b87b3b60b735… — Score 84/100 — Hybrid Analysis","description":"Malicious verdict for sample b87b3b60b735…. Malware family: Win/malicious_confidence_100%. Threat score 84/100. 8/27 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c"],"about":{"@type":"SoftwareApplication","name":"1.exe","applicationCategory":["peexe","executable"],"identifier":"b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c","additionalType":"Malicious sample"},"threatScore":84,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5ee,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "1.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "1.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "1.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "1.exe") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "1.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "1.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "1.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp")26:T47b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "1.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "1.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "1.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "WebView2: CoreWebView2Environment failed when trying to LoadLibrary: hr=0x" (Indicator: "LoadLibrary"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp")27:T7c0,Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "1.exe") Found api reference "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "1.exe") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; File: "1.exe") Found api reference "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "1.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "1.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "1.exe") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "1.exe") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "1.exe") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "1.exe") Found api reference "CryptSignHashW" (Indicator: "CryptSignHashW"; File: "1.exe") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "1.exe") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; File: "1.exe") Found api reference "CryptEnumProvidersW" (Indicator: "CryptEnumProvidersW"; File: "1.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "1.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "1.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "1.exe") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; File: "1.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "1.exe") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "1.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "1.exe") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp")28:T946,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9404-03F22149 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9404-03F22149 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9451-03F27696 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00002820-9783-9535-03F2A8E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9535-03F2A8E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9566-03F27CD3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9566-03F27CD3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9567-03F29B13 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9567-03F29B13 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9661-03F26E45 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9661-03F26E45 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9662-03F28AAE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9662-03F28AAE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9664-03F28A65 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9664-03F28A65 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9914-03F236C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9914-03F236C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9941-03F213B8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9941-03F213B8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002820-9783-9943-03F21105 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002820-9783-9943-03F21105 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00002820-9783-9969-03F24FBC Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002820-9783-9969-03F24FBC Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00002820-9783-9969-03F24FBC29:T57b,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "1.exe") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "1.exe") Found reference to API "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "1.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "1.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "1.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "1.exe") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "1.exe") Found reference to API "CryptSignHashW" (Indicator: "CryptSignHash"; File: "1.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "1.exe") Found reference to API "CryptExportKey" (Indicator: "CryptExportKey"; File: "1.exe") Found reference to API "CryptEnumProvidersW" (Indicator: "CryptEnumProviders"; File: "1.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "1.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "1.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "1.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "1.exe")2a:T2d67,Found XOR loop in file "lock.dll" at offset 813372; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 836757; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 1096849; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 1096871; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2543604; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2578701; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2659802; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2838117; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2850677; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2852141; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2861313; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2870955; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2880379; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2882435; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2885285; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2886311; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2888345; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2889339; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2892555; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2894013; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2899753; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2900739; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2903415; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2905463; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2907515; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2909563; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2911571; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2913623; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2915673; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2916107; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2919493; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 2924523; code bytes = 30d0 Found XOR loop in file "lock.dll" at offset 553339; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 554822; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 555246; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 555786; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 556213; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 682106; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 682181; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 825348; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 835736; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 835756; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959178; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959199; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959221; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959248; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959259; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959411; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959431; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959453; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959480; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959491; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959596; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959616; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959638; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959665; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959676; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959821; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959841; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959863; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959897; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 959910; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 963319; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 999349; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1095966; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1096006; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1096041; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1098591; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1099286; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1099607; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1100987; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1101653; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1101676; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1103374; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1103819; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1105525; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1105708; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1105930; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1106048; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1107045; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1107326; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1107449; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1112187; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1118503; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1118521; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1118537; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1119972; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1127048; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1127277; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1137130; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1137155; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1137170; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1137196; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1145295; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1145583; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1232116; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1232299; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1482244; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1482514; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1482885; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1500156; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1503042; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1503741; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1503822; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1504447; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1504933; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1505009; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1513075; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1520301; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1522881; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1590010; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1597400; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1762869; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 1763488; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 2481987; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 2580372; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 2634200; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 2839083; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 2842149; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 2860651; code bytes = 33c1 Found XOR loop in file "lock.dll" at offset 172902; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 586942; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 617889; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 854449; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 867455; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 1791459; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 1792075; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2440250; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2441657; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2442296; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2709528; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2709692; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2719092; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2843682; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2849358; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2850070; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2857298; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2868438; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2880348; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2883112; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2883768; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2884298; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2885266; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2887316; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2888326; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2890244; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2903376; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2905426; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2907476; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2909524; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2911532; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2913584; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2915634; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2916098; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2917784; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2919908; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2920422; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2921442; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2921964; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2922228; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2924156; code bytes = 8030 Found XOR loop in file "lock.dll" at offset 2924484; code bytes = 80302b:T465,Found system information discovery API: "GetEnvironmentStrings" in file "1.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "1.exe" Found system information discovery API: "GetSystemInfo" in file "1.exe" Found system information discovery API: "ExpandEnvironmentStringsA" in file "1.exe" Found system information discovery API: "GetUserObjectInformationW" in file "1.exe" Found system information discovery API: "GetNativeSystemInfo" in file "1.exe" Found system information discovery API: "GetMonitorInfoA" in file "00000000-00002820.00000001.156857.00401000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationA" in file "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00002820.00000001.156857.03E8D000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp"2c:T479,Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "1.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "1.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "1.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "1.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "1.exe") Found reference to API "WTSSendMessageW" (Indicator: "sendmessage"; File: "1.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp")2d:T4e0,"1.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002820) "1.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002820)2e:T5ef,"1.exe" called "LoadLibrary" with a parameter C:\Kernel32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter MSIMG32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter MSVCRT.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter MSVFW32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter C:\gdiplus.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002820) "1.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002820)2f:T6a4f,"1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetSystemDEPPolicy (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ImageList_Draw (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TransparentBlt (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DrawDibOpen (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GlobalReAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ImageList_GetIcon (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ImageList_GetImageInfo (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ImageList_GetIconSize (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetWindowExtEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetWindowOrgEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetMapMode (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SelectClipPath (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EndPath (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter BeginPath (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TextOutA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetPixel (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreatePatternBrush (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateFontIndirectA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetViewportOrgEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32A (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateRoundRectRgn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateFontA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetViewportExtEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter OffsetRgn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CombineRgn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreatePen (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ExtCreateRegion (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter Rectangle (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetPixel (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter PtInRegion (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter PatBlt (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetObjectA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetTextExtentPointA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ExtTextOutA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ??3@YAXPAX@Z (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter __CxxFrameHandler (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ??2@YAPAXI@Z (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter _ftol (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter _mbsstr (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter _mbscmp (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter __dllonexit (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter _adjust_fdiv (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DrawDibDraw (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DrawDibClose (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetWindowsHookExA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter UnhookWindowsHookEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetClassNameA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LockWindowUpdate (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DrawStateA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetMenuItemID (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetWindowRgn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetMenu (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetMenu (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetSubMenu (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TrackPopupMenu (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetClassLongA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SystemParametersInfoA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter MenuItemFromPoint (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetMenuItemRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetMenuItemCount (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetMenuItemInfoA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsMenu (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetUpdateRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EqualRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ShowScrollBar (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetWindowRgn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter WindowFromDC (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EnableScrollBar (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetScrollPos (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetScrollInfo (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetScrollRange (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetScrollPos (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetScrollInfo (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetDCEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetWindowLongA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FindWindowExA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetMenuItemInfoA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetComboBoxInfo (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter InflateRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetPropA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RemovePropA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetPropA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetWindowLongA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetRectEmpty (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DrawIconEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DrawTextA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsRectEmpty (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsZoomed (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetMenuState (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ReleaseCapture (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetScrollRange (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter PtInRect (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetCapture (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter UpdateLayeredWindow (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter lstrcpyn (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter URLDownloadToFileW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00002820) "1.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00002820)30:Tfaee,Found reference to API (Indicator: "RegQueryValueExA"; File: "1.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "1.exe") Found reference to API (Indicator: "RegCreateKeyA"; File: "1.exe") Found reference to API (Indicator: "RegCloseKey"; File: "1.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "1.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "1.exe") Found reference to API (Indicator: "RoundRect"; File: "1.exe") Found reference to API (Indicator: "ExtTextOutA"; File: "1.exe") Found reference to API (Indicator: "GetDIBits"; File: "1.exe") Found reference to API (Indicator: "CreateDCA"; File: "1.exe") Found reference to API (Indicator: "TextOutA"; File: "1.exe") Found reference to API (Indicator: "DPtoLP"; File: "1.exe") Found reference to API (Indicator: "SetMapMode"; File: "1.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "1.exe") Found reference to API (Indicator: "GetBkColor"; File: "1.exe") Found reference to API (Indicator: "GetCurrentObject"; File: "1.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "1.exe") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "1.exe") Found reference to API (Indicator: "GetObjectA"; File: "1.exe") Found reference to API (Indicator: "DeleteDC"; File: "1.exe") Found reference to API (Indicator: "CreatePatternBrush"; File: "1.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "1.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "1.exe") Found reference to API (Indicator: "GetStockObject"; File: "1.exe") Found reference to API (Indicator: "BitBlt"; File: "1.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "1.exe") Found reference to API (Indicator: "SelectObject"; File: "1.exe") Found reference to API (Indicator: "StretchBlt"; File: "1.exe") Found reference to API (Indicator: "GetTextColor"; File: "1.exe") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "1.exe") Found reference to API (Indicator: "DeleteObject"; File: "1.exe") Found reference to API (Indicator: "GetTextMetricsA"; File: "1.exe") Found reference to API (Indicator: "CreateFontA"; File: "1.exe") Found reference to API (Indicator: "CreateFontIndirectA"; File: "1.exe") Found reference to API (Indicator: "ResumeThread"; File: "1.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "1.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "1.exe") Found reference to API (Indicator: "WinExec"; File: "1.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "1.exe") Found reference to API (Indicator: "IsBadWritePtr"; File: "1.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "1.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "1.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "1.exe") Found reference to API (Indicator: "LocalReAlloc"; File: "1.exe") Found reference to API (Indicator: "OpenProcess"; File: "1.exe") Found reference to API (Indicator: "HeapCreate"; File: "1.exe") Found reference to API (Indicator: "GetTickCount"; File: "1.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "1.exe") Found reference to API (Indicator: "VirtualFree"; File: "1.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "1.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "1.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "1.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "1.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "1.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "1.exe") Found reference to API (Indicator: "TerminateProcess"; File: "1.exe") Found reference to API (Indicator: "Process32First"; File: "1.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "1.exe") Found reference to API (Indicator: "SetHandleCount"; File: "1.exe") Found reference to API (Indicator: "IsBadCodePtr"; File: "1.exe") Found reference to API (Indicator: "RtlUnwind"; File: "1.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "1.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "1.exe") Found reference to API (Indicator: "GetFileTime"; File: "1.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "1.exe") Found reference to API (Indicator: "LocalAlloc"; File: "1.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "1.exe") Found reference to API (Indicator: "VirtualProtect"; File: "1.exe") Found reference to API (Indicator: "HeapDestroy"; File: "1.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "1.exe") Found reference to API (Indicator: "WriteFile"; File: "1.exe") Found reference to API (Indicator: "lstrlenA"; File: "1.exe") Found reference to API (Indicator: "GetFileSize"; File: "1.exe") Found reference to API (Indicator: "FindNextFileA"; File: "1.exe") Found reference to API (Indicator: "IsBadReadPtr"; File: "1.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "1.exe") Found reference to API (Indicator: "GlobalFree"; File: "1.exe") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "1.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "1.exe") Found reference to API (Indicator: "GetVersionExA"; File: "1.exe") Found reference to API (Indicator: "EnumResourceTypesA"; File: "1.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "1.exe") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "1.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "1.exe") Found reference to API (Indicator: "SetLastError"; File: "1.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "1.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "1.exe") Found reference to API (Indicator: "CreateEventA"; File: "1.exe") Found reference to API (Indicator: "GetFileType"; File: "1.exe") Found reference to API (Indicator: "OpenThread"; File: "1.exe") Found reference to API (Indicator: "EnumResourceTypesW"; File: "1.exe") Found reference to API (Indicator: "EnumResourceNamesA"; File: "1.exe") Found reference to API (Indicator: "VirtualQuery"; File: "1.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "1.exe") Found reference to API (Indicator: "CompareStringA"; File: "1.exe") Found reference to API (Indicator: "LocalFree"; File: "1.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "1.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "1.exe") Found reference to API (Indicator: "HeapSize"; File: "1.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "1.exe") Found reference to API (Indicator: "CreateFileW"; File: "1.exe") Found reference to API (Indicator: "lstrcpynA"; File: "1.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "1.exe") Found reference to API (Indicator: "FreeLibrary"; File: "1.exe") Found reference to API (Indicator: "FindClose"; File: "1.exe") Found reference to API (Indicator: "MulDiv"; File: "1.exe") Found reference to API (Indicator: "GlobalReAlloc"; File: "1.exe") Found reference to API (Indicator: "LoadResource"; File: "1.exe") Found reference to API (Indicator: "GetStdHandle"; File: "1.exe") Found reference to API (Indicator: "CreateMutexA"; File: "1.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "1.exe") Found reference to API (Indicator: "HeapFree"; File: "1.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "1.exe") Found reference to API (Indicator: "lstrcmpA"; File: "1.exe") Found reference to API (Indicator: "Thread32Next"; File: "1.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "1.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "1.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "1.exe") Found reference to API (Indicator: "GetLastError"; File: "1.exe") Found reference to API (Indicator: "GetLocalTime"; File: "1.exe") Found reference to API (Indicator: "SetStdHandle"; File: "1.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "1.exe") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "1.exe") Found reference to API (Indicator: "LockResource"; File: "1.exe") Found reference to API (Indicator: "lstrlenW"; File: "1.exe") Found reference to API (Indicator: "GetCPInfo"; File: "1.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "1.exe") Found reference to API (Indicator: "CreateThread"; File: "1.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "1.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "1.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "1.exe") Found reference to API (Indicator: "GlobalFlags"; File: "1.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "1.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "1.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "1.exe") Found reference to API (Indicator: "CreateFileA"; File: "1.exe") Found reference to API (Indicator: "CompareStringW"; File: "1.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "1.exe") Found reference to API (Indicator: "GetOEMCP"; File: "1.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "1.exe") Found reference to API (Indicator: "FindResourceExW"; File: "1.exe") Found reference to API (Indicator: "ReadFile"; File: "1.exe") Found reference to API (Indicator: "TerminateThread"; File: "1.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "1.exe") Found reference to API (Indicator: "GetACP"; File: "1.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "1.exe") Found reference to API (Indicator: "GetProcAddress"; File: "1.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "1.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "1.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "1.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "1.exe") Found reference to API (Indicator: "lstrcpyA"; File: "1.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "1.exe") Found reference to API (Indicator: "EnumResourceLanguagesW"; File: "1.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "1.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "1.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "1.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "1.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "1.exe") Found reference to API (Indicator: "GetVersion"; File: "1.exe") Found reference to API (Indicator: "GetProcessVersion"; File: "1.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "1.exe") Found reference to API (Indicator: "DeleteFileA"; File: "1.exe") Found reference to API (Indicator: "GlobalFindAtomA"; File: "1.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "1.exe") Found reference to API (Indicator: "TlsFree"; File: "1.exe") Found reference to API (Indicator: "SetFilePointer"; File: "1.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "1.exe") Found reference to API (Indicator: "GlobalHandle"; File: "1.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "1.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "1.exe") Found reference to API (Indicator: "TlsGetValue"; File: "1.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "1.exe") Found reference to API (Indicator: "GlobalLock"; File: "1.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "1.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "1.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "1.exe") Found reference to API (Indicator: "LockFile"; File: "1.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "1.exe") Found reference to API (Indicator: "SuspendThread"; File: "1.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "1.exe") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "1.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "1.exe") Found reference to API (Indicator: "Process32Next"; File: "1.exe") Found reference to API (Indicator: "FindResourceA"; File: "1.exe") Found reference to API (Indicator: "GlobalSize"; File: "1.exe") Found reference to API (Indicator: "ExitProcess"; File: "1.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "1.exe") Found reference to API (Indicator: "TlsSetValue"; File: "1.exe") Found reference to API (Indicator: "SetErrorMode"; File: "1.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "1.exe") Found reference to API (Indicator: "GetLogicalDriveStringsA"; File: "1.exe") Found reference to API (Indicator: "GetProfileStringA"; File: "1.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "1.exe") Found reference to API (Indicator: "TlsAlloc"; File: "1.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "1.exe") Found reference to API (Indicator: "LCMapStringW"; File: "1.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "1.exe") Found reference to API (Indicator: "lstrcatA"; File: "1.exe") Found reference to API (Indicator: "CreateProcessA"; File: "1.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "1.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "1.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "1.exe") Found reference to API (Indicator: "Thread32First"; File: "1.exe") Found reference to API (Indicator: "FindResourceExA"; File: "1.exe") Found reference to API (Indicator: "GlobalAddAtomA"; File: "1.exe") Found reference to API (Indicator: "GlobalGetAtomNameA"; File: "1.exe") Found reference to API (Indicator: "RaiseException"; File: "1.exe") Found reference to API (Indicator: "GetSystemTime"; File: "1.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "1.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "1.exe") Found reference to API (Indicator: "SetEvent"; File: "1.exe") Found reference to API (Indicator: "HeapAlloc"; File: "1.exe") Found reference to API (Indicator: "LCMapStringA"; File: "1.exe") Found reference to API (Indicator: "Sleep"; File: "1.exe") Found reference to API (Indicator: "UnlockFile"; File: "1.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "1.exe") Found reference to API (Indicator: "CloseHandle"; File: "1.exe") Found reference to API (Indicator: "VariantInit"; File: "1.exe") Found reference to API (Indicator: "SysAllocString"; File: "1.exe") Found reference to API (Indicator: "VariantCopy"; File: "1.exe") Found reference to API (Indicator: "VariantClear"; File: "1.exe") Found reference to API (Indicator: "SafeArrayGetElement"; File: "1.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "1.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "1.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "1.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "1.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "1.exe") Found reference to API (Indicator: "VariantChangeType"; File: "1.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "1.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "1.exe") Found reference to API (Indicator: "Shell_NotifyIconA"; File: "1.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "1.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "1.exe") Found reference to API (Indicator: "PtInRect"; File: "1.exe") Found reference to API (Indicator: "DeleteMenu"; File: "1.exe") Found reference to API (Indicator: "TranslateAcceleratorA"; File: "1.exe") Found reference to API (Indicator: "IsZoomed"; File: "1.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "1.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "1.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "1.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "1.exe") Found reference to API (Indicator: "GetParent"; File: "1.exe") Found reference to API (Indicator: "GetScrollPos"; File: "1.exe") Found reference to API (Indicator: "RegisterClipboardFormatA"; File: "1.exe") Found reference to API (Indicator: "SetFocus"; File: "1.exe") Found reference to API (Indicator: "SetCursor"; File: "1.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "1.exe") Found reference to API (Indicator: "ReleaseDC"; File: "1.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "1.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "1.exe") Found reference to API (Indicator: "CreateMenu"; File: "1.exe") Found reference to API (Indicator: "SetScrollPos"; File: "1.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "1.exe") Found reference to API (Indicator: "TabbedTextOutA"; File: "1.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "1.exe") Found reference to API (Indicator: "GetCapture"; File: "1.exe") Found reference to API (Indicator: "GetMessageA"; File: "1.exe") Found reference to API (Indicator: "SetScrollRange"; File: "1.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "1.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "1.exe") Found reference to API (Indicator: "IsIconic"; File: "1.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "1.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "1.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "1.exe") Found reference to API (Indicator: "WinHelpA"; File: "1.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "1.exe") Found reference to API (Indicator: "OpenClipboard"; File: "1.exe") Found reference to API (Indicator: "DrawTextA"; File: "1.exe") Found reference to API (Indicator: "SetMenu"; File: "1.exe") Found reference to API (Indicator: "GetClipboardData"; File: "1.exe") Found reference to API (Indicator: "InflateRect"; File: "1.exe") Found reference to API (Indicator: "CreateIconFromResourceEx"; File: "1.exe") Found reference to API (Indicator: "RemovePropA"; File: "1.exe") Found reference to API (Indicator: "IntersectRect"; File: "1.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "1.exe") Found reference to API (Indicator: "DestroyCursor"; File: "1.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "1.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "1.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "1.exe") Found reference to API (Indicator: "KillTimer"; File: "1.exe") Found reference to API (Indicator: "ShowWindow"; File: "1.exe") Found reference to API (Indicator: "wsprintfA"; File: "1.exe") Found reference to API (Indicator: "RegisterClassA"; File: "1.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "1.exe") Found reference to API (Indicator: "WindowFromPoint"; File: "1.exe") Found reference to API (Indicator: "MessageBoxW"; File: "1.exe") Found reference to API (Indicator: "SetWindowsHookExA"; File: "1.exe") Found reference to API (Indicator: "GetClassNameA"; File: "1.exe") Found reference to API (Indicator: "GetClientRect"; File: "1.exe") Found reference to API (Indicator: "SetMenuItemBitmaps"; File: "1.exe") Found reference to API (Indicator: "FillRect"; File: "1.exe") Found reference to API (Indicator: "LoadBitmapA"; File: "1.exe") Found reference to API (Indicator: "SetCapture"; File: "1.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "1.exe") Found reference to API (Indicator: "IsChild"; File: "1.exe") Found reference to API (Indicator: "SetClipboardData"; File: "1.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "1.exe") Found reference to API (Indicator: "FindWindowExA"; File: "1.exe") Found reference to API (Indicator: "GetCursor"; File: "1.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "1.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "1.exe") Found reference to API (Indicator: "GetKeyState"; File: "1.exe") Found reference to API (Indicator: "SetPropA"; File: "1.exe") Found reference to API (Indicator: "TranslateMessage"; File: "1.exe") Found reference to API (Indicator: "AppendMenuA"; File: "1.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "1.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "1.exe") Found reference to API (Indicator: "GetScrollRange"; File: "1.exe") Found reference to API (Indicator: "DestroyIcon"; File: "1.exe") Found reference to API (Indicator: "BeginPaint"; File: "1.exe") Found reference to API (Indicator: "PeekMessageA"; File: "1.exe") Found reference to API (Indicator: "RedrawWindow"; File: "1.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "1.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "1.exe") Found reference to API (Indicator: "GetCursorPos"; File: "1.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "1.exe") Found reference to API (Indicator: "DrawIconEx"; File: "1.exe") Found reference to API (Indicator: "EqualRect"; File: "1.exe") Found reference to API (Indicator: "PostMessageA"; File: "1.exe") Found reference to API (Indicator: "GetPropA"; File: "1.exe") Found reference to API (Indicator: "FrameRect"; File: "1.exe") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; File: "1.exe") Found reference to API (Indicator: "GetSubMenu"; File: "1.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "1.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "1.exe") Found reference to API (Indicator: "DestroyWindow"; File: "1.exe") Found reference to API (Indicator: "SetCursorPos"; File: "1.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "1.exe") Found reference to API (Indicator: "GetWindowTextA"; File: "1.exe") Found reference to API (Indicator: "SetParent"; File: "1.exe") Found reference to API (Indicator: "GetDC"; File: "1.exe") Found reference to API (Indicator: "DrawEdge"; File: "1.exe") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "1.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "1.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "1.exe") Found reference to API (Indicator: "RegisterHotKey"; File: "1.exe") Found reference to API (Indicator: "CloseClipboard"; File: "1.exe") Found reference to API (Indicator: "CopyRect"; File: "1.exe") Found reference to API (Indicator: "DestroyMenu"; File: "1.exe") Found reference to API (Indicator: "GetMenuStringA"; File: "1.exe") Found reference to API (Indicator: "GetWindowDC"; File: "1.exe") Found reference to API (Indicator: "LoadStringA"; File: "1.exe") Found reference to API (Indicator: "GetTopWindow"; File: "1.exe") Found reference to API (Indicator: "OffsetRect"; File: "1.exe") Found reference to API (Indicator: "SendMessageA"; File: "1.exe") Found reference to API (Indicator: "SetWindowRgn"; File: "1.exe") Found reference to API (Indicator: "UnregisterHotKey"; File: "1.exe") Found reference to API (Indicator: "GetMenu"; File: "1.exe") Found reference to API (Indicator: "ModifyMenuA"; File: "1.exe") Found reference to API (Indicator: "GetWindowRect"; File: "1.exe") Found reference to API (Indicator: "ClientToScreen"; File: "1.exe") Found reference to API (Indicator: "InvalidateRect"; File: "1.exe") Found reference to API (Indicator: "SetRect"; File: "1.exe") Found reference to API (Indicator: "GetWindow"; File: "1.exe") Found reference to API (Indicator: "GrayStringA"; File: "1.exe") Found reference to API (Indicator: "CharUpperA"; File: "1.exe") Found reference to API (Indicator: "ScreenToClient"; File: "1.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "1.exe") Found reference to API (Indicator: "CreateAcceleratorTableA"; File: "1.exe") Found reference to API (Indicator: "SetWindowPos"; File: "1.exe") Found reference to API (Indicator: "GetMenuState"; File: "1.exe") Found reference to API (Indicator: "UpdateWindow"; File: "1.exe") Found reference to API (Indicator: "GetMessageTime"; File: "1.exe") Found reference to API (Indicator: "IsRectEmpty"; File: "1.exe") Found reference to API (Indicator: "LoadIconA"; File: "1.exe") Found reference to API (Indicator: "GetSysColor"; File: "1.exe") Found reference to API (Indicator: "LoadCursorA"; File: "1.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "1.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "1.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "1.exe") Found reference to API (Indicator: "LoadImageA"; File: "1.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "1.exe") Found reference to API (Indicator: "IsWindow"; File: "1.exe") Found reference to API (Indicator: "GetFocus"; File: "1.exe") Found reference to API (Indicator: "SetTimer"; File: "1.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "1.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "1.exe") Found reference to API (Indicator: "CopyAcceleratorTableA"; File: "1.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "1.exe") Found reference to API (Indicator: "EnableWindow"; File: "1.exe") Found reference to API (Indicator: "MessageBoxA"; File: "1.exe") Found reference to API (Indicator: "MoveWindow"; File: "1.exe") Found reference to API (Indicator: "FindWindowA"; File: "1.exe") Found reference to API (Indicator: "CreateIconFromResource"; File: "1.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "1.exe") Found reference to API (Indicator: "gethostname"; File: "1.exe") Found reference to API (Indicator: "recvfrom"; File: "1.exe") Found reference to API (Indicator: "inet_ntoa"; File: "1.exe") Found reference to API (Indicator: "closesocket"; File: "1.exe") Found reference to API (Indicator: "WSAAsyncSelect"; File: "1.exe") Found reference to API (Indicator: "getpeername"; File: "1.exe") Found reference to API (Indicator: "ntohl"; File: "1.exe") Found reference to API (Indicator: "ioctlsocket"; File: "1.exe") Found reference to API (Indicator: "WSACleanup"; File: "1.exe") Found reference to API (Indicator: "WSAStartup"; File: "1.exe") Found reference to API (Indicator: "WTSSendMessageW"; File: "1.exe") Found reference to API (Indicator: "OleInitialize"; File: "1.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "1.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "1.exe") Found reference to API (Indicator: "OleUninitialize"; File: "1.exe") Found reference to API (Indicator: "CryptAcquireContextW"; File: "1.exe") Found reference to API (Indicator: "CryptGetUserKey"; File: "1.exe") Found reference to API (Indicator: "CryptSetHashParam"; File: "1.exe") Found reference to API (Indicator: "CryptGetProvParam"; File: "1.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "1.exe") Found reference to API (Indicator: "ReportEventW"; File: "1.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "1.exe") Found reference to API (Indicator: "CryptCreateHash"; File: "1.exe") Found reference to API (Indicator: "CryptGenRandom"; File: "1.exe") Found reference to API (Indicator: "CryptDestroyKey"; File: "1.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "1.exe") Found reference to API (Indicator: "CryptDecrypt"; File: "1.exe") Found reference to API (Indicator: "CryptSignHashW"; File: "1.exe") Found reference to API (Indicator: "CryptDestroyHash"; File: "1.exe") Found reference to API (Indicator: "CryptExportKey"; File: "1.exe") Found reference to API (Indicator: "CryptEnumProvidersW"; File: "1.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "1.exe") Found reference to API (Indicator: "CertOpenStore"; File: "1.exe") Found reference to API (Indicator: "CertCloseStore"; File: "1.exe") Found reference to API (Indicator: "CertGetCertificateContextProperty"; File: "1.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "1.exe") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "1.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "1.exe") Found reference to API (Indicator: "FindResourceW"; File: "1.exe") Found reference to API (Indicator: "InterlockedExchangeAdd"; File: "1.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "1.exe") Found reference to API (Indicator: "DeleteTimerQueueTimer"; File: "1.exe") Found reference to API (Indicator: "MapViewOfFileEx"; File: "1.exe") Found reference to API (Indicator: "CreateTimerQueue"; File: "1.exe") Found reference to API (Indicator: "ConvertThreadToFiber"; File: "1.exe") Found reference to API (Indicator: "ConvertFiberToThread"; File: "1.exe") Found reference to API (Indicator: "CancelWaitableTimer"; File: "1.exe") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "1.exe") Found reference to API (Indicator: "CreateTimerQueueTimer"; File: "1.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "1.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "1.exe") Found reference to API (Indicator: "CreateFiber"; File: "1.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "1.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "1.exe") Found reference to API (Indicator: "DeleteTimerQueueEx"; File: "1.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "1.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "1.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "1.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "1.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "1.exe") Found reference to API (Indicator: "SwitchToFiber"; File: "1.exe") Found reference to API (Indicator: "DeleteFiber"; File: "1.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "1.exe") Found reference to API (Indicator: "SwitchToThread"; File: "1.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "1.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "1.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "1.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "1.exe") Found reference to API (Indicator: "ExitThread"; File: "1.exe") Found reference to API (Indicator: "CreateWaitableTimerA"; File: "1.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "1.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "1.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "1.exe") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "1.exe") Found reference to API (Indicator: "PathFileExistsA"; File: "1.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "1.exe") Found reference to API (Indicator: "WSAIoctl"; File: "1.exe") Found reference to API (Indicator: "WSAStringToAddressA"; File: "1.exe") Found reference to API (Indicator: "htonl"; File: "1.exe") Found reference to API (Indicator: "getsockname"; File: "1.exe") Found reference to API (Indicator: "getsockopt"; File: "1.exe") Found reference to API (Indicator: "ntohs"; File: "1.exe") Found reference to API (Indicator: "htons"; File: "1.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "1.exe") Found reference to API (Indicator: "WSAAddressToStringA"; File: "1.exe") Found reference to API (Indicator: "WSASetLastError"; File: "1.exe") Found reference to API (Indicator: "WSASend"; File: "1.exe") Found reference to API (Indicator: "WSAGetOverlappedResult"; File: "1.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp, 00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp, 00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp, 00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp, 00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp, 00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp, 00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002820.00000001.156857.03F0C000.00000020.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp, 00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp") Found reference to API (Indicator: "URLDownloadToFileW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002820.00000001.156857.0BCA0000.00000004.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; Source: "00000000-00002820.00000001.156857.0BCA0000.00000004.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002820.00000001.156857.0BCA0000.00000004.mdmp") Found reference to API (Indicator: "UpdateLayeredWindow"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GlobalReAlloc"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "TextOutA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreatePatternBrush"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateFontIndirectA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "ExtTextOutA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetTextColor"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetWindowsHookExA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetMenuItemRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetMenuItemInfoA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "EqualRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "ShowScrollBar"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetScrollInfo"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetScrollPos"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetMenuItemInfoA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetPropA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "RemovePropA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetPropA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetMenuState"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "RegisterClassExA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp")31:T49f,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "1.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "1.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "1.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "1.exe") Found reference to API "FindResourceExA" (Indicator: "FindResource"; File: "1.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "1.exe") Found reference to API "LdrFindResource_U" (Indicator: "FindResource"; Source: "00000000-00002820.00000001.156857.0BCA0000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp")32:T832,"lock.dll" contains export function called "Create_HP_BrotliCompressor" at ordinal 1 "lock.dll" contains export function called "Create_HP_BrotliCompressorEx" at ordinal 2 "lock.dll" contains export function called "Create_HP_BrotliDecompressor" at ordinal 3 "lock.dll" contains export function called "Create_HP_GZipCompressor" at ordinal 4 "lock.dll" contains export function called "Create_HP_GZipCompressorEx" at ordinal 5 "lock.dll" contains export function called "Create_HP_GZipDecompressor" at ordinal 6 "lock.dll" contains export function called "Create_HP_HttpAgent" at ordinal 7 "lock.dll" contains export function called "Create_HP_HttpAgentListener" at ordinal 8 "lock.dll" contains export function called "Create_HP_HttpClient" at ordinal 9 "lock.dll" contains export function called "Create_HP_HttpClientListener" at ordinal 10 "lock.dll" contains export function called "Create_HP_HttpServer" at ordinal 11 "lock.dll" contains export function called "Create_HP_HttpServerListener" at ordinal 12 "lock.dll" contains export function called "Create_HP_HttpSyncClient" at ordinal 13 "lock.dll" contains export function called "Create_HP_HttpsAgent" at ordinal 14 "lock.dll" contains export function called "Create_HP_HttpsClient" at ordinal 15 "lock.dll" contains export function called "Create_HP_HttpsServer" at ordinal 16 "lock.dll" contains export function called "Create_HP_HttpsSyncClient" at ordinal 17 "lock.dll" contains export function called "Create_HP_SSLAgent" at ordinal 18 "lock.dll" contains export function called "Create_HP_SSLClient" at ordinal 19 "lock.dll" contains export function called "Create_HP_SSLPackAgent" at ordinal 20 "lock.dll" contains export function called "Create_HP_SSLPackClient" at ordinal 21 "lock.dll" contains export function called "Create_HP_SSLPackServer" at ordinal 22 "lock.dll" contains export function called "Create_HP_SSLPullAgent" at ordinal 23 "lock.dll" contains export function called "Create_HP_SSLPullClient" at ordinal 24 "lock.dll" contains export function called "Create_HP_SSLPullServer" at ordinal 2533:T4bf,"1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73380000 "1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74300000 "1.exe" loaded module "KERNEL32.DLL" at base 74e90000 "1.exe" loaded module "COMCTL32.DLL" at base 73ac0000 "1.exe" loaded module "GDI32.DLL" at base 777f0000 "1.exe" loaded module "MSIMG32.DLL" at base 73550000 "1.exe" loaded module "MSVCRT.DLL" at base 75d10000 "1.exe" loaded module "MSVFW32.DLL" at base 735d0000 "1.exe" loaded module "USER32.DLL" at base 77370000 "1.exe" loaded module "DCIMAN32.DLL" at base 73370000 "1.exe" loaded module "GDIPLUS.DLL" at base 74540000 "1.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 74540000 "1.exe" loaded module "ADVAPI32.DLL" at base 77ac0000 "1.exe" loaded module "OLE32.DLL" at base 75bc0000 "1.exe" loaded module "SHELL32.DLL" at base 76030000 "1.exe" loaded module "SHLWAPI.DLL" at base 75cc0000 "1.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74e90000 "1.exe" loaded module "URLMON.DLL" at base 74140000 "1.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 74e9000034:T4d5,"1.exe" file has an entrypoint instructions - "push 0xc1c1ea26,call 0x4226216,jmp ebp,add dl, dl,push 0x584463c2,lds edx, ptr [esi + edi*8],or esp, ecx,lea ebp, [eax + 0x39],retf ,cli ,retf ,lodsb al, byte ptr [esi],scasd eax, dword ptr es:[edi],pop ebp,pushfd ,test al, 0x13,out 0xcd, eax,mov eax, dword ptr [0xa6fd718a],std ,loopne 0x708436a,sbb dword ptr [ebp + 0x76], ebp,rcr byte ptr [esi], 1,sbb cl, ah,adc dword ptr [edi], 0x10b15a83,hlt ,stc ,and al, 0x74,push 0x6f,adc al, 0x73,sbb eax, 0x847a45d5,inc ebx,jne 0x7084424,mov dh, 0x78,jne 0x708442a,and byte ptr [eax + 0x72], cl,or dword ptr [edx + 0xc907b19], ebx,sub dword ptr [edi - 0x51], edi,mov esp, 0x8c397918,pop ds," "lock.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1019956b,call 0x101a4620,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10199465,pop ecx,pop ebp,ret 0xc,mov eax, 0x101a5165,mov dword ptr [0x102b0460], eax,mov dword ptr [0x102b0464], 0x101a485b,mov dword ptr [0x102b0468], 0x101a480f,mov dword ptr [0x102b046c], 0x101a4848,mov dword ptr [0x102b0470], 0x101a47b1,mov dword ptr [0x102b0474], eax,mov dword ptr [0x102b0478], 0x101a50dd,"35:T4f4,"1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")36:T970,"1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "1.EXE"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")37:T481,"1.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "1.exe" trying to access non-existent file "C:\WINMM.DLL" "1.exe" trying to access non-existent file "C:\MSVFW32.DLL" "1.exe" trying to access non-existent file "C:\AVIFIL32.DLL" "1.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "1.exe" trying to access non-existent file "C:\MSACM32.DLL" "1.exe" trying to access non-existent file "C:\MSIMG32.DLL" "1.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "1.exe" trying to access non-existent file "C:\BCRYPT.DLL" "1.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "1.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1.exe" trying to access non-existent file "C:\MSVCP140.DLL" "1.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "1.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "1.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "1.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "1.exe" trying to access non-existent file "C:\KERNEL32.DLL" "1.exe" trying to access non-existent file "C:\Kernel32.dll"38:Td48,Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "1.exe") Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "1.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "1.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "1.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "1.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "1.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "1.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "1.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp")39:T838,Found reference to API "Process32First" (Indicator: "Process32First"; File: "1.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "1.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1.exe") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "1.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "1.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "1.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "1.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "1.exe") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "1.exe") Found reference to API "GetCurrentProcessExplicitAppUserModelID" (Indicator: "GetCurrentProcess"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp")3a:T4ba,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "1.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "1.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "1.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "1.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "1.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002820.00000001.156857.10000000.00000040.mdmp")3b:T45b,RegCreateKeyExA RegCreateKeyA RegCloseKey RegOpenKeyExA WinExec GetModuleFileNameA OpenProcess GetTickCount GetStartupInfoA GetFileAttributesA TerminateProcess Process32First LoadLibraryW IsDebuggerPresent VirtualProtect WriteProcessMemory WriteFile GetFileSize FindNextFileA GetVersionExA CreateToolhelp32Snapshot VirtualAlloc GetCommandLineA UnhandledExceptionFilter CreateFileW GetModuleHandleA FindFirstFileA LockResource CreateThread CreateDirectoryA CreateFileA FindResourceExW GetDriveTypeA GetProcAddress LoadLibraryA DeleteFileA GetModuleHandleW Process32Next FindResourceA GetSystemInfo CreateProcessA FindResourceExA GetModuleFileNameW Sleep ShellExecuteA GetClipboardData SetWindowsHookExA GetWindowThreadProcessId FindWindowExA GetLastActivePopup GetCursorPos FindWindowA recvfrom accept closesocket recv WSAStartup FindResourceW MapViewOfFileEx GetStartupInfoW GetNativeSystemInfo GetDriveTypeW CreateFileMappingA ExitThread FindNextFileW FindFirstFileW FindFirstFileExA WSASendTo connect bind listen socket sendto WSASend send3c:Tdec,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAKOElEQVR4XsWXeVBUVxrFm7GszExSSjcqURbZCQjIYoQGRzOJqGimMpOqxKgs0RiFzFSBmmUmNq2iItoKioIacYlLnFSURWSLGGjMgo4aI5k4QEKMmjgGDWv36w3PnPteA8bk/3lVp7773rv3nd/97tK3VapfudwOOzBqvwmjSszwMFrgdU6CV5MZnk2SUywbJfn54DMPZ/QaipYhifr+nwzgYZ9fXOr9dri+04fRe01wdcqrUcgML6N5qCw+KKI37wc19F6GMykQ4plR+YZ3k6hDfWr9dRDXEgvUe/ug3qMYq/f0YdQefkyYDxnxow3DpgfHeuB69BR8GxWDjO2nMNH53HMQdAh+uI2scw9BaEqscKXx6N19cN3dD9ddPej4oQeuxf3wbhCmEiM/1tAvA0zk/UTGXeM80BAUgm9jYlDjG4RjS5JZT7ShKeUpS2njKdqJrDX0Ke/P2YchXIuZ9uJeSollbX2oarqKtu+7MbGeDT8SMis6a4IP47TaS/Dl82J3D3RETkEHM3GdmbBdXQ7vs6I+oVlPyKNBiQJczmCDKJsUALd3rHCjsbqoF65FjLt60XrzHtYUHkW18Qp8q3vgU88en2EjEamiXbMQUncLvvVmbJjlgbzZvng7KQD2i2/BfnUZ69LkDAH43pvtvOoH25rkDniz7HNWgn8js6Ap6od6J3tPqXf2QF3Yg4qzF7Bmx1Fm4Qr8y3+Cz4fSsPjhuo3j4fhwCuZNVOHKtEDkPjMBjq+W03wpbF8sgy8BfM5YaEgxijbefCbfy52RCC8gCOC2sw9uhX3Q7KA55UYADbXngzM4XvsZ/nOzCxNr2aiW5DWMdRICWG5e+wisp0NweVIYpMpJsFZNgu2jeL7nHKgzw0duo9SXxTYiiue+tSKyTp2NADTVFHDC5XdDk0+Qgm75fkz+Peh3HEHDhX/D9zRTWMWG1WxI+Tn1O5UKA5XP4REXF9hLDZAI5Kgw4PrUKWiPikLpn19GaFU/65qVtjXiG2b4yQBUHTMwdnuvbOiW/4AEwLYu7D1xFtUchoBTJvid5phRIvpVCdmA0gKgIh8D5dtwv2wr7JXheIxQo6nPwyPRHhnJiRmJkrHjEV7RJ0P7V1sIYVVUx81pDA0127rhtpXR0MXYRXMCbO2G7oMWZO84BktlKAw1BQg4bYWfgKm0I5jlgYbj0IwYgfvlBXiUpnYOBaqn4j0PH9yIjsGh8d7IzMqiViBn2TL4n5KU9qcs7IyJMAQYMt7yE8ZsobkoG7oJ0AVH1ROwVQYjPWosbCdz4V9mRmC5Hf4VdhzbnI/fu6iAqkL8huaPsvwYdYPLsSMyCkcf90TSnLlYuXIVVq16HSupwHKalvMbBAkkRGCVgwA0dcvjuOd1QSPKQlt/QkF9BxJzz6N9zSvoLHoT1pObYCk3IKjMjj8cv4N2/WJ5DghjWSxnZKTjS8NjuN+Silmzk5CYOAeZmSuw4e+LYG1ZCnvLcgSXmggiyQpgR1RjttzFx6234XA4YLfbYbPbYLOa5LKdz669nYJWQiyNdoeDYz3XS4X27DS0rk/Hm2+swkgnhEjz2hnjMXAlFbi6iMZZyFqxCvZTQfhi00jc2JgubzzBJ0wIKiXASWagTExC9lizxIj80mZINKz85Kpi7oRpIUD72iVIj3FHkrcKc6jmbA1adWnIEuObmYnZs+fg9eenQ//UBLy1YCbmJc2FnSvCXhGEm7lLcSs/E1LZZgQe6ULQB2YEn+Aw/JMZOCky8Mo52G1WGtoekAIg1K5Lxec0+2v0OKB+hgzRpk9DW/bLGLyWp/8NK2PHYd10D6zIEj3P4hDMwe0dmbiZl47vDa/BWrqZykPgexKCjksIpoLet3AOLGmC2+Im1JxvHRqGhxV8mEPCjabgxcfxGTegVkK1ZacOAQxejpNbMMDlOHPmbGycNR6va0fDUZcAlOlkcwERctSEJ45JlAnB74udcLECUCsD/NJcKORdNjpsRlP2CJovRivNW7NTcPFWP659d4fW92HnBBXLcaBiKzejbRioCcOGRA+snzmB8OGQTubBVrqFABJCjlCHLXjiuABgBjQvN6K6udVpKIbjIYADJoQcFCL5Ed4fsWISdf/+AC623cal9jsYOGFgT7cSIF8GsFeFYuPM8Uif/Fs4TofDwuxc1kazM/zGIUmOAkY1hr3XpIkhuCabnf605SEAG0JKTMM6YEbouzaEHbL+LP031i/hKiEAMyGyYKdpbuIE5M7yZDkU87lSOqIJIMz5DdGZ4ENm/hqmNUKd2gj3RWXyEHT2OJegPBkl2DgvTJbhyXmP92EHbZh88OcA4hoggKPMgGmRwZimnYoZ8XGYkRCH50ImYSGX67cEKE7OQQjPmyH7mUXCyABulIi1HIaqoaGw4S9vbMdLuhIsyC7BfMbBVRLGc6Nx2Vw0Z/wJAe6jUOblKwO8y61XmMRrE7DzhVAUPh+EV5+JwFPxsQrAk1Pk92H7JITvM7Mj4jyQZpSHQJPKychy4NJKzodrKKy4gO0V5/F5203cutuNfdUXsKvyEu519yFstxmNy5JwLmMeatKfxQkvPxx83EsGaI2JxA+5y9FzQMc5sQ23N2fIIAs5BNvHuuNrnprCBcA7FoTxKKgSxpqUJqiTjU6Ij1F7oV1eFZ2dnb/Qfzu7EF5sgvHVOWhKn4em1+bhOAG+i2HvpsSiPjSCGxDnQLmQgWUDXqT5ghEqJDuHIYKnsPDdEiJKxCpIYfpTjFAzqlMEhBHVnJC1zW2403nXaTwYOxHJo9vkIjMieGI++4+RaNC54BlvF3wXGYPakEi8QBNLjZ5LbjP3BQNsLa9hLp8tIEQy9Q3PCdeipyJitwmT9wkAGqqTRQYUABHz3lNWhZgTHd8r5nd/vIvYHBNiN0iK1kuI2iXRXIVEahZ/I6bt7cVLKhd8lvMoPtaPhHQqBHX6SUhUjUAE64YV2/FNdCSP8dGIKrYgaq+cgQZoFjXCdZERcWtNsjYd5cZ04Wt5d3ww/bE5ZsStMyN2nYgmPEXTRGqmlwIgyqL90x68J5R++jhkT3dHVKEJUTvMiNkpIX3dZVyfHIkMfTNiiiTlZByXY0es3oyplDbHgjPNX8oTsYY/TA8CNHzVRWOJJmYkrOnGHz0U86c9VZgf7IKPdCMQkHIJQWkXse3ZABjm+cu/kAGpl+FPafU99OnDk/pexBQ6zcWlXWtBXDYBspnibKZXjiacbzPhrmz+I37osiFOT3O+9029Ar/kf1H8b7DwInySL7J8nuaMKVdgmOsPQ5KfIpb9Ui7Dl3X8+T6BAFq9CfFrzD//dxRPiFhCJAiQ1QqAgIrTKWXxLk5nlgHl59n90DLGvtUJ3wXN8FvYLAP506i1ciFsVUHydizVavnNXoqmNBdtE3TOPyUPX1Pn70G8yMDqfsQJiNUS4kVkA62Oxm/TlBBanQXa1cOAWkpE0TaO9bS6fjlTSll5P433CXoLYl4o/HXz/9f1P3BKEojnZVHkAAAAAElFTkSuQmCC3d:Tdec,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAKOElEQVR4XsWXeVBUVxrFm7GszExSSjcqURbZCQjIYoQGRzOJqGimMpOqxKgs0RiFzFSBmmUmNq2iItoKioIacYlLnFSURWSLGGjMgo4aI5k4QEKMmjgGDWv36w3PnPteA8bk/3lVp7773rv3nd/97tK3VapfudwOOzBqvwmjSszwMFrgdU6CV5MZnk2SUywbJfn54DMPZ/QaipYhifr+nwzgYZ9fXOr9dri+04fRe01wdcqrUcgML6N5qCw+KKI37wc19F6GMykQ4plR+YZ3k6hDfWr9dRDXEgvUe/ug3qMYq/f0YdQefkyYDxnxow3DpgfHeuB69BR8GxWDjO2nMNH53HMQdAh+uI2scw9BaEqscKXx6N19cN3dD9ddPej4oQeuxf3wbhCmEiM/1tAvA0zk/UTGXeM80BAUgm9jYlDjG4RjS5JZT7ShKeUpS2njKdqJrDX0Ke/P2YchXIuZ9uJeSollbX2oarqKtu+7MbGeDT8SMis6a4IP47TaS/Dl82J3D3RETkEHM3GdmbBdXQ7vs6I+oVlPyKNBiQJczmCDKJsUALd3rHCjsbqoF65FjLt60XrzHtYUHkW18Qp8q3vgU88en2EjEamiXbMQUncLvvVmbJjlgbzZvng7KQD2i2/BfnUZ69LkDAH43pvtvOoH25rkDniz7HNWgn8js6Ap6od6J3tPqXf2QF3Yg4qzF7Bmx1Fm4Qr8y3+Cz4fSsPjhuo3j4fhwCuZNVOHKtEDkPjMBjq+W03wpbF8sgy8BfM5YaEgxijbefCbfy52RCC8gCOC2sw9uhX3Q7KA55UYADbXngzM4XvsZ/nOzCxNr2aiW5DWMdRICWG5e+wisp0NweVIYpMpJsFZNgu2jeL7nHKgzw0duo9SXxTYiiue+tSKyTp2NADTVFHDC5XdDk0+Qgm75fkz+Peh3HEHDhX/D9zRTWMWG1WxI+Tn1O5UKA5XP4REXF9hLDZAI5Kgw4PrUKWiPikLpn19GaFU/65qVtjXiG2b4yQBUHTMwdnuvbOiW/4AEwLYu7D1xFtUchoBTJvid5phRIvpVCdmA0gKgIh8D5dtwv2wr7JXheIxQo6nPwyPRHhnJiRmJkrHjEV7RJ0P7V1sIYVVUx81pDA0127rhtpXR0MXYRXMCbO2G7oMWZO84BktlKAw1BQg4bYWfgKm0I5jlgYbj0IwYgfvlBXiUpnYOBaqn4j0PH9yIjsGh8d7IzMqiViBn2TL4n5KU9qcs7IyJMAQYMt7yE8ZsobkoG7oJ0AVH1ROwVQYjPWosbCdz4V9mRmC5Hf4VdhzbnI/fu6iAqkL8huaPsvwYdYPLsSMyCkcf90TSnLlYuXIVVq16HSupwHKalvMbBAkkRGCVgwA0dcvjuOd1QSPKQlt/QkF9BxJzz6N9zSvoLHoT1pObYCk3IKjMjj8cv4N2/WJ5DghjWSxnZKTjS8NjuN+Silmzk5CYOAeZmSuw4e+LYG1ZCnvLcgSXmggiyQpgR1RjttzFx6234XA4YLfbYbPbYLOa5LKdz669nYJWQiyNdoeDYz3XS4X27DS0rk/Hm2+swkgnhEjz2hnjMXAlFbi6iMZZyFqxCvZTQfhi00jc2JgubzzBJ0wIKiXASWagTExC9lizxIj80mZINKz85Kpi7oRpIUD72iVIj3FHkrcKc6jmbA1adWnIEuObmYnZs+fg9eenQ//UBLy1YCbmJc2FnSvCXhGEm7lLcSs/E1LZZgQe6ULQB2YEn+Aw/JMZOCky8Mo52G1WGtoekAIg1K5Lxec0+2v0OKB+hgzRpk9DW/bLGLyWp/8NK2PHYd10D6zIEj3P4hDMwe0dmbiZl47vDa/BWrqZykPgexKCjksIpoLet3AOLGmC2+Im1JxvHRqGhxV8mEPCjabgxcfxGTegVkK1ZacOAQxejpNbMMDlOHPmbGycNR6va0fDUZcAlOlkcwERctSEJ45JlAnB74udcLECUCsD/NJcKORdNjpsRlP2CJovRivNW7NTcPFWP659d4fW92HnBBXLcaBiKzejbRioCcOGRA+snzmB8OGQTubBVrqFABJCjlCHLXjiuABgBjQvN6K6udVpKIbjIYADJoQcFCL5Ed4fsWISdf/+AC623cal9jsYOGFgT7cSIF8GsFeFYuPM8Uif/Fs4TofDwuxc1kazM/zGIUmOAkY1hr3XpIkhuCabnf605SEAG0JKTMM6YEbouzaEHbL+LP031i/hKiEAMyGyYKdpbuIE5M7yZDkU87lSOqIJIMz5DdGZ4ENm/hqmNUKd2gj3RWXyEHT2OJegPBkl2DgvTJbhyXmP92EHbZh88OcA4hoggKPMgGmRwZimnYoZ8XGYkRCH50ImYSGX67cEKE7OQQjPmyH7mUXCyABulIi1HIaqoaGw4S9vbMdLuhIsyC7BfMbBVRLGc6Nx2Vw0Z/wJAe6jUOblKwO8y61XmMRrE7DzhVAUPh+EV5+JwFPxsQrAk1Pk92H7JITvM7Mj4jyQZpSHQJPKychy4NJKzodrKKy4gO0V5/F5203cutuNfdUXsKvyEu519yFstxmNy5JwLmMeatKfxQkvPxx83EsGaI2JxA+5y9FzQMc5sQ23N2fIIAs5BNvHuuNrnprCBcA7FoTxKKgSxpqUJqiTjU6Ij1F7oV1eFZ2dnb/Qfzu7EF5sgvHVOWhKn4em1+bhOAG+i2HvpsSiPjSCGxDnQLmQgWUDXqT5ghEqJDuHIYKnsPDdEiJKxCpIYfpTjFAzqlMEhBHVnJC1zW2403nXaTwYOxHJo9vkIjMieGI++4+RaNC54BlvF3wXGYPakEi8QBNLjZ5LbjP3BQNsLa9hLp8tIEQy9Q3PCdeipyJitwmT9wkAGqqTRQYUABHz3lNWhZgTHd8r5nd/vIvYHBNiN0iK1kuI2iXRXIVEahZ/I6bt7cVLKhd8lvMoPtaPhHQqBHX6SUhUjUAE64YV2/FNdCSP8dGIKrYgaq+cgQZoFjXCdZERcWtNsjYd5cZ04Wt5d3ww/bE5ZsStMyN2nYgmPEXTRGqmlwIgyqL90x68J5R++jhkT3dHVKEJUTvMiNkpIX3dZVyfHIkMfTNiiiTlZByXY0es3oyplDbHgjPNX8oTsYY/TA8CNHzVRWOJJmYkrOnGHz0U86c9VZgf7IKPdCMQkHIJQWkXse3ZABjm+cu/kAGpl+FPafU99OnDk/pexBQ6zcWlXWtBXDYBspnibKZXjiacbzPhrmz+I37osiFOT3O+9029Ar/kf1H8b7DwInySL7J8nuaMKVdgmOsPQ5KfIpb9Ui7Dl3X8+T6BAFq9CfFrzD//dxRPiFhCJAiQ1QqAgIrTKWXxLk5nlgHl59n90DLGvtUJ3wXN8FvYLAP506i1ciFsVUHydizVavnNXoqmNBdtE3TOPyUPX1Pn70G8yMDqfsQJiNUS4kVkA62Oxm/TlBBanQXa1cOAWkpE0TaO9bS6fjlTSll5P433CXoLYl4o/HXz/9f1P3BKEojnZVHkAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":84,"unified_at_epoch_ms":1791424111794,"unified_at":"2026-10-08T01:48:31.794Z","metadata":{"hashes":{"sha256":"b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c","sha1":"01a9fc496ffab7972d6a1a32adbefa8f9e2cec16","md5":"81e98b864789ad79176a464a7e1f7676","sha512":"cab2eb5f5d23a8715d127216df180c8541d8abcfb324e880859cda5b124290847090a2b68f7ff4a74ada2acfd2e1f219f8aaeeb68e3c73ebb9dcf07a81478dea","ssdeep":"786432:3MD2hJ1MX2DpxgQ05RcvyiQjC+JSM2SqPn7BNEzzA7EQBHoJ8pRGa7GmlONBJhp+:cD2j1wcxd05MSjCSqzBNEvA7EQuWz7AU","ssdeep_chunks":["786432:3MD2hJ1","786432:MD2hJ1M","786432:D2hJ1MX","786432:2hJ1MX2","786432:hJ1MX2D","786432:J1MX2Dp","786432:1MX2Dpx","786432:MX2Dpxg","786432:X2DpxgQ","786432:2DpxgQ0","786432:DpxgQ05","786432:pxgQ05R","786432:xgQ05Rc","786432:gQ05Rcv","786432:Q05Rcvy","786432:05Rcvyi","786432:5RcvyiQ","786432:RcvyiQj","786432:cvyiQjC","786432:vyiQjC+","786432:yiQjC+J","786432:iQjC+JS","786432:QjC+JSM","786432:jC+JSM2","786432:C+JSM2S","786432:+JSM2Sq","786432:JSM2SqP","786432:SM2SqPn","786432:M2SqPn7","786432:2SqPn7B","786432:SqPn7BN","786432:qPn7BNE","786432:Pn7BNEz","786432:n7BNEzz","786432:7BNEzzA","786432:BNEzzA7","786432:NEzzA7E","786432:EzzA7EQ","786432:zzA7EQB","786432:zA7EQBH","786432:A7EQBHo","786432:7EQBHoJ","786432:EQBHoJ8","786432:QBHoJ8p","786432:BHoJ8pR","786432:HoJ8pRG","786432:oJ8pRGa","786432:J8pRGa7","786432:8pRGa7G","786432:pRGa7Gm","786432:RGa7Gml","786432:Ga7GmlO","786432:a7GmlON","786432:7GmlONB","786432:GmlONBJ","786432:mlONBJh","786432:lONBJhp","786432:ONBJhp+","1572864:3MD2hJ1","1572864:MD2hJ1M","1572864:D2hJ1MX","1572864:2hJ1MX2","1572864:hJ1MX2D","1572864:J1MX2Dp","1572864:1MX2Dpx","1572864:MX2Dpxg","1572864:X2DpxgQ","1572864:2DpxgQ0","1572864:DpxgQ05","1572864:pxgQ05R","1572864:xgQ05Rc","1572864:gQ05Rcv","1572864:Q05Rcvy","1572864:05Rcvyi","1572864:5RcvyiQ","1572864:RcvyiQj","1572864:cvyiQjC","1572864:vyiQjC+","1572864:yiQjC+J","1572864:iQjC+JS","1572864:QjC+JSM","1572864:jC+JSM2","1572864:C+JSM2S","1572864:+JSM2Sq","1572864:JSM2SqP","1572864:SM2SqPn","1572864:M2SqPn7","1572864:2SqPn7B","1572864:SqPn7BN","1572864:qPn7BNE","1572864:Pn7BNEz","1572864:n7BNEzz","1572864:7BNEzzA","1572864:BNEzzA7","1572864:NEzzA7E","1572864:EzzA7EQ","1572864:zzA7EQB","1572864:zA7EQBH","1572864:A7EQBHo","1572864:7EQBHoJ","1572864:EQBHoJ8","1572864:QBHoJ8p","1572864:BHoJ8pR","1572864:HoJ8pRG","1572864:oJ8pRGa","1572864:J8pRGa7","1572864:8pRGa7G","1572864:pRGa7Gm","1572864:RGa7Gml","1572864:Ga7GmlO","1572864:a7GmlON","1572864:7GmlONB","1572864:GmlONBJ","1572864:mlONBJh","1572864:lONBJhp","1572864:ONBJhp+","786432:cD2j1wc","786432:D2j1wcx","786432:2j1wcxd","786432:j1wcxd0","786432:1wcxd05","786432:wcxd05M","786432:cxd05MS","786432:xd05MSj","786432:d05MSjC","786432:05MSjCS","786432:5MSjCSq","786432:MSjCSqz","786432:SjCSqzB","786432:jCSqzBN","786432:CSqzBNE","786432:SqzBNEv","786432:qzBNEvA","786432:zBNEvA7","786432:BNEvA7E","786432:NEvA7EQ","786432:EvA7EQu","786432:vA7EQuW","786432:A7EQuWz","786432:7EQuWz7","786432:EQuWz7A","786432:QuWz7AU"],"imphash":"cd44d3dd99f5947904ffa3d6ca7a61a5"},"file_info":{"file_name":"1.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":50139136,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786056965000,"last_seen":1786057942000,"last_multi_scan":1786057942000}},"detections":{"summary":{"verdict":"malicious","score":84,"tags":null},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":162,"suspicious_count":12,"malicious_count":3,"total":177},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.VMProtect.ACR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.02216021","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Adware ( 005693e61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/FlyStudio.W.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Agent.OSCF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Uses Windows cryptography API for obfuscation"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"informative","value":"Sets a windows hook"},{"type":"malicious","value":"Sets a computer-based training (CBT) hook"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"Unknown compression method in IHDR\" (Source: \"00000000-00002820.00000001.156857.03E8D000.00000004.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00002820.00000001.156857.03E8D000.00000004.mdmp\")\n Found string \"bad compression method\" (Source: \"00000000-00002820.00000001.156857.03E8D000.00000004.mdmp\")\n Found string \"unknown compression type\" (Source: \"00000000-00002820.00000001.156857.03E8D000.00000004.mdmp\")\n Found string \"bad compression info\" (Source: \"00000000-00002820.00000001.156857.03E8D000.00000004.mdmp\")\n Found string \"text compression mode is out of range\" (Source: \"00000000-00002820.00000001.156857.03E8D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"1.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"1.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"1.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"1.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"1.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"1.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"1.exe\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002820.00000001.156857.09890000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"1.exe\" queried SystemProcessInformation at 00000000-00002820-00000C15-1434422250 [PID: 2820]\n \"1.exe\" queried SystemProcessInformation at 00000000-00002820-00000C15-1434431930 [PID: 2820]\n \"1.exe\" queried SystemProcessInformation at 00000000-00002820-00000C15-1440941506 [PID: 2820]\n \"1.exe\" queried SystemProcessInformation at 00000000-00002820-00000C15-1440949492 [PID: 2820]\n \"1.exe\" queried SystemProcessInformation at 00000000-00002820-00000C15-1441013531 [PID: 2820]\n \"1.exe\" queried SystemProcessInformation at 00000000-00002820-00000C15-1441021183 [PID: 2820]\n \"1.exe\" queried SystemProcessInformation at 00000000-00002820-00000C15-1442695210 [PID: 2820]\n \"1.exe\" queried SystemProcessInformation at 00000000-00002820-00000C15-1442703770 [PID: 2820]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007388]\n Process \"WerFault.exe\" [UID: 00000000-00003352]\n Process \"WerFault.exe\" [UID: 00000000-00001644]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"1.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"1.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"1.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002820-9783-9404-03F22149\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002820-9783-9405-03F20F58\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002820-9783-9451-03F27696","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".vmps0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$27","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"1.exe\")\n Found reference to API \"CryptGetUserKey\" (Indicator: \"CryptGetUserKey\"; File: \"1.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"1.exe\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"1.exe\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"1.exe\")\n Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"1.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"1.exe\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"1.exe\")\n Found reference to API \"CryptExportKey\" (Indicator: \"CryptExportKey\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002820.00000000.156220.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.09890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Uses Windows cryptography API for obfuscation\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2a","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"1.exe\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; File: \"1.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameW\" (Source: \"00000000-00002820.00000000.156220.09890000.00000004.mdmp\")\n Found string \"wv2_Webview_BasicAuthenticationRequestedArgs_UserName_Attr\" (Source: \"00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"1.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"1.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002820-00000C2C-1442800446\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"1.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"1.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"1.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"1.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"1.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002820)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002820)\n \"1.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002820)\n \"1.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002820)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"1.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002820)\n \"1.exe\" called \"GetMonitorInfoA\" with parameters (UID: 00000000-00002820)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"1.exe\" called \"IsWow64Process\" with parameter \"2820\" - (UID: 00000000-00002820)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"1.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002820)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"1.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b3612574e4f95607000000008cfb5607506ae077c3759b04fefffffff9dedb77a59971770210000000000000000000000010000000000000000000005b4308079cfb5607f9dedb77 (UID: 00000000-00002820)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: lock.dll]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002820-9783-9969-03F24FBC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"1.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"1.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002820-9783-9969-03F24FBC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002820-9783-9969-03F24FBC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002820-9783-9664-03F28A65","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"1.exe\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"1.exe\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"1.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"1.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"1.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; File: \"1.exe\")\n Found reference to API \"GetWindowTextLengthA\" (Indicator: \"GetWindowText\"; File: \"1.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"1.exe\")\n Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; File: \"1.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"1.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"1.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")\n Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"1.exe\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"1.exe\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"1.exe\")\n Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002820.00000000.156220.09890000.00000004.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"1.exe\"\n Found registry modification API: \"RegCreateKeyA\" in file \"1.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"1.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"1.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"1.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"1.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\.MspTool\\ (UID: 00000000-00002820)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"1.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"1.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"1.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002820-9783-9398-03F2432C\n Sleep@KERNEL32.DLL at 00000000-00002820-9783-9419-03F2424D\n Sleep@KERNEL32.DLL at 00000000-00002820-9783-9430-03F24292\n Sleep@KERNEL32.DLL at 00000000-00002820-9783-9604-03F242DE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"1.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 1.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002820-9783-9401-03F2979B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"1.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"1.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"1.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"1.exe\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"1.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"1.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"1.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"1.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"1.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"1.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"1.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"1.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"1.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$32","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\\" in Source: 9783-3966-004BDF70\n \"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\n \"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\n \"Software\\\" in Source: 00000000-00002820.00000001.156857.03E8D000.00000004.mdmp\n \"stry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WOW\\boot\" in Source: 00000000-00002820.00000001.156857.09890000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Edge\\WebView2\\\" in Source: 00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"lock.dll\" as clean (type is \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"1.exe\" failed to load missing module \"C:\\Kernel32.dll\" - [base:0; Status:c0000135]\n \"1.exe\" failed to load missing module \"C:\\kernel32.dll\" - [base:0; Status:c0000135]\n \"1.exe\" failed to load missing module \"C:\\gdiplus.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"lock.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\\" in Source: 00000000-00002820.00000001.156857.03E8D000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\n \"\\Registry\\Machine\\Software\\Classes\\\" in Source: 00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\n \"stry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\WOW\\boot\" in Source: 00000000-00002820.00000001.156857.09890000.00000004.mdmp\n \"Software\\Policies\\Microsoft\\Edge\\WebView2\\\" in Source: 00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75E60000\n \"1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73730000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 774F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"1.exe\" was detected as \"VMProtect\" and name: \"Protector\"\n \"1.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"lock.dll\" was detected as \"VMProtect\" and name: \"Protector\"\n \"lock.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"lock.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"1.exe\" has an executable section named \".text\"\n \"1.exe\" has an executable section named \".vmps0\"\n \"1.exe\" has an executable section named \".vmps1\"\n \"lock.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"1.exe\" has an writable section named \".data\"\n \"lock.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$34","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".vmps1\" is \"0x2f73000\" greater than 0x100000\n Raw size of \".text\" is \"0x1b3000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1aac06\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x38e00ac\" greater than 0x100000\n Virtual size of \".vmps0\" is \"0x2f7a5e\" greater than 0x100000\n Virtual size of \".vmps1\" is \"0x2f723e0\" greater than 0x100000\n Virtual size of \".text\" is \"0x1b2e43\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"1.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 7444","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"1.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"lock.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"1.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"1.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp\")\n Found reference to API \"WebView2: CoreWebView2Environment failed when trying to LoadLibrary: hr=0x\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"1.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"lock.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%ALLUSERSPROFILE%\\.MspTool\\lock.dll]- [targetUID: 00000000-00002820]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"lock.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%ALLUSERSPROFILE%\\.MspTool\\lock.dll]- [targetUID: 00000000-00002820]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"1.exe\" queries basic process information of the \"C:\\1.exe\" (UID: 2820)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"1.exe\" reads file \"c:\\1.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"1.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"1.exe\" trying to touch file \"C:\\1.exe\"\n \"1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"1.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"1.exe\" trying to touch file \"C:\\WINMM.DLL\"\n \"1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winmm.dll\"\n \"1.exe\" trying to touch file \"C:\\MSVFW32.DLL\"\n \"1.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvfw32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"1.exe\" trying to access non-existent file \"C:\\1.EXE.LOCAL\"\n \"1.exe\" trying to access non-existent file \"C:\\WINSPOOL.DRV\"\n \"1.exe\" trying to access non-existent file \"C:\\1.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"1.exe\" writes file \"c:\\programdata\\.msptool\\lock.dll\"\n \"1.exe\" writes file \"%allusersprofile%\\.msptool\\lock.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"1.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"1.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"1.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"1.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"1.exe\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"1.exe\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"1.exe\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"1.exe\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp\")\n Found reference to API \"URLDownloadToFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"1.exe\")\n Found reference to API \"inet_ntoa\" (Indicator: \"inet_ntoa\"; File: \"1.exe\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"1.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"1.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"1.0.0.1\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"3_.ir\"\n Heuristic match: \"h..as\"\n Heuristic match: \"ju.pw\"\n Heuristic match: \"+(.nr\"\n Heuristic match: \"4'.hn\"\n Heuristic match: \"m;.su\"\n Heuristic match: \"5y.rw\"\n Pattern match: \"http://www.eyuyan.com\"\n Pattern match: \"www.dywt.com.cn\"\n Heuristic match: \"xe;.bat;.cm\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"st@.st\"\n Heuristic match: \",wae.ki\"\n Pattern match: \"https://go.microsoft.com/fwlink/p/?linkid=2124703\"\n Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.eyuyan.com)varfileinfotranslationihdrsrgbgama\" - Source: \"00000000-00002820.00000000.156220.07177000.00000002.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002820.00000000.156220.09890000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002820.00000001.156857.09890000.00000004.mdmp\")\n Found URL \"https://go.microsoft.com/fwlink/p/?linkid=2124703runasmicrosoftedgewebview2setup.exe\" - Source: \"00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp\")\n Found URL \"http://!this\" - Source: \"00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"lock.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSSendMessageW\" (Indicator: \"WTSSendMessage\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileA\" (File: \"1.exe\")\n Found string \"GetClipboardData\" (File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 1.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: lock.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in file \"1.exe\"\n Found registry query API: \"RegQueryValueA\" in file \"1.exe\"\n Found registry query API: \"RegOpenKeyExA\" in file \"1.exe\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"1.exe\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"1.exe\")\n Found reference to API \"UnregisterHotKey\" (Indicator: \"UnregisterHotKey\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"1.exe\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"1.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: 1.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"1.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"1.exe\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"1.exe\" called \"FindFirstFileA\" with parameter %ALLUSERSPROFILE%\\.MspTool\\lock.dll (UID: 00000000-00002820)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"1.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 1.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"1.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"1.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"1.exe\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"1.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"1.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"1.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"1.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"1.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002820.00000001.156857.09890000.00000004.mdmp, 00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp, 00000000-00002820.00000001.156857.0BC2F000.00000004.mdmp, 00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"1.exe\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"1.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"1.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"1.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"1.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"1.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 1.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002820.00000000.156220.09890000.00000004.mdmp\")\n Found string \"NDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002820.00000001.156857.09890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"1.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"1.exe\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"1.exe\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"1.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002820.00000001.156857.10000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 1.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"1.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"1.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002820.00000001.156857.03F0C000.00000020.mdmp, 00000000-00002820.00000001.156857.0BBF0000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"1.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002820.00000001.156857.0BC1E000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"1.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\MULTIMEDIA\\DRAWDIB\"; Key: \"1280X1024X32(BGR 0)\"; Value: \"31\n31\n31\n31\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"1.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"1.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"lock.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"1.exe\" has section name .vmps1 with entropy \"7.999392413435018\"\n \"1.exe\" has section name .rsrc with entropy \"7.897241484222504\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses Windows cryptography API for obfuscation","description":"Observed Cryptography api used in \"advapi32.dll\" [Source: lock.dll]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":3,"id":"static-207","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/26 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"1.exe\" has resource with unusual entropy \"RT_ICON:7.912188791760309\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"lock.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%ALLUSERSPROFILE%\\.MspTool\\lock.dll]- [targetUID: 00000000-00002820]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"1.exe\" wrote 62464 bytes starting with PE header signature to file \"C:\\ProgramData\\.MspTool\\lock.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00002820-9783-9925-03F207D9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00002820-9783-9399-03F274B2\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00002820-9783-9946-03F24B59","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.DLL at 00000000-00002820-9783-9404-03F22149\n TerminateProcess@KERNEL32.DLL at 00000000-00002820-9783-9405-03F20F58\n ExitProcess@KERNEL32.DLL at 00000000-00002820-9783-9427-03F243B0\n TerminateProcess@KERNEL32.DLL at 00000000-00002820-9783-9831-03F10D40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"SetWindowLongA@USER32.DLL\" in \"1.exe\"\n \"ExtTextOutA@GDI32.DLL\" in \"1.exe\"\n \"NtUserEndPaint@WIN32U.DLL\" in \"1.exe\"\n \"GetWindowLongA@USER32.DLL\" in \"1.exe\"\n \"NtUserBeginPaint@WIN32U.DLL\" in \"1.exe\"\n \"ExtTextOutW@GDI32.DLL\" in \"1.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"1.exe\" has an entrypoint in section \".vmps1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$3b","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\" was dropped at \"%ALLUSERSPROFILE%\\.MspTool\\lock.dll\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"1.exe\" sets a callback procedure (599b34) using filter \"WH_CBT\" for process ID: b04","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6a7514d35c08ff9a000e857f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":84,"malware_family":"Packed.VMProtect","submit_name":"1.exe","analysis_start_time":"2026-08-06T23:12:26+00:00","indicators_count":{"informative":162,"suspicious":28,"malicious":3},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}],"processes":[{"pid":2820,"ppid":0,"name":"1.exe","command_line":"","sha256":"b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c","normalized_path":"C:\\1.exe","uid":"00000000-00002820","icon":"$3c"},{"pid":3352,"ppid":2820,"name":"WerFault.exe","command_line":"-u -p 2820 -s 756","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002820","uid":"00000000-00003352"},{"pid":1644,"ppid":2820,"name":"WerFault.exe","command_line":"-u -p 2820 -s 756","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002820","uid":"00000000-00001644"},{"pid":7388,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 2820 -ip 2820","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007388","icon":"$3d"}],"all_imported_dlls":["uxtheme.dll","ws2_32.dll","rpcrt4.dll","kernel32.dll","bcrypt.dll","kernel.appcore.dll","msacm32.dll","msctf.dll","imagehlp.dll","msvcp_win.dll","imm32.dll","dwmapi.dll","ntdll.dll","KernelBase.dll","combase.dll","ucrtbase.dll","cfgmgr32.dll","oleaut32.dll","win32u.dll","vcruntime140.dll","msvfw32.dll","ole32.dll","msimg32.dll","IPHLPAPI.DLL","msvcp140.dll","gdi32.dll","SHCore.dll","shell32.dll","sspicli.dll","msvcrt.dll","advapi32.dll","profapi.dll","cryptsp.dll","apphelp.dll","winmmbase.dll","comdlg32.dll","VxSSL32.dll","fltLib.dll","urlmon.dll","user32.dll","windows.storage.dll","GdiPlus.dll","wow64win.dll","bcryptprimitives.dll","sechost.dll","winmm.dll","cryptbase.dll","comctl32.dll","shlwapi.dll","powrprof.dll","iertutil.dll","dciman32.dll","wow64.dll","gdi32full.dll","wtsapi32.dll","wow64cpu.dll","avifil32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"lock.dll","sha256":"0e11b955048104466ed8d86db346628c1b30118ae116fa0428b0c34f486d8cf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]},{"path":"%ALLUSERSPROFILE%\\.MspTool\\lock.dll","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\MULTIMEDIA\\DRAWDIB\\","sources":[{"report_type":"sandbox","report_id":"6a7514d35c08ff9a000e857f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6a7514d35c08ff9a000e857f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample b87b3b60b735… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b87b3b60b735…. Malware family: Win/malicious_confidence_100%. Threat score 84/100. 8/27 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample b87b3b60b735… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b87b3b60b735…. Malware family: Win/malicious_confidence_100%. Threat score 84/100. 8/27 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b87b3b60b7350747ba6998f50204c78ef0a6fb11281a35c9d15b52ea4765a75c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample b87b3b60b735… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b87b3b60b735…. Malware family: Win/malicious_confidence_100%. Threat score 84/100. 8/27 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3e","11",{}]]