25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:Te5a,Found reference to API "SendMessageW(tab,TCM_GETITEMCOUNT,0,0)==4" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageW(tab,TCM_GETITEMCOUNT,0,0)==6" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageW(tab,TCM_GETITEMCOUNT,0,0)==1" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageTimeoutW(main,WM_NULL,0,0,SMTO_ABORTIFHUNG,1000,&answer)" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageTimeoutW(main,WM_NULL,0x97,0,SMTO_ABORTIFHUNG,1000,&answer)" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageW(found.sheet,PSM_APPLY,0,0)&&PostMessageW(found.sheet,WM_COMMAND,IDCANCEL,0)" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(input_control,WM_KEYDOWN,VK_RETURN,0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "SendMessageW(slider,TBM_GETRANGEMIN,0,0)==10&&SendMessageW(slider,TBM_GETRANGEMAX,0,0)==20 &&SendMessageW(slider,TBM_GETNUMTICS,0,0)==11&&SendMessageW(slider,TBM_GETPOS,0,0)==levels[old_scene] &&SendDlgItemMessageW(page,103,BM_GETCHECK,0,0)==BST_UNCHECKED&&SendDlgItemMessageW(page,radios[old_scene],BM_GETCHECK,0,0)==BST_CHECKED" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageTimeoutW(main,WM_NULL,0x101,0,SMTO_ABORTIFHUNG,10000,&answer)&&observer.pixel_completed.load()==1" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(cancel,BM_CLICK,0,0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(main,WM_COMMAND,2008,0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(GetDlgItem(find.sheet,IDOK),BM_CLICK,0,0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(h,WM_CHAR,'a',0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(GetAncestor(h,GA_ROOT),WM_KEYDOWN,VK_RETURN,0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "find.sheet&&!IsWindowEnabled(main)&&SendMessageW(GetDlgItem(find.sheet,0x3020),TCM_GETITEMCOUNT,0,0)==3" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageTimeoutW(main,WM_NULL,177,0,SMTO_ABORTIFHUNG,5000,&answer)" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(sheet,PSM_PRESSBUTTON,PSBTN_CANCEL,0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "SendMessageTimeoutW(main,WM_NULL,0,0,SMTO_ABORTIFHUNG,1000,&value)" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageTimeoutW(main,WM_COMMAND,2012,0,SMTO_ABORTIFHUNG,5000,&value)" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(GetAncestor(h,GA_ROOT),WM_KEYDOWN,VK_DOWN,0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "PostMessageW(GetAncestor(h,GA_ROOT),WM_KEYDOWN,VK_RIGHT,0)" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "GetParent(page)==sheet&&SendMessageW(tab,TCM_GETCURSEL,0,0)==0" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageW(receiver,WM_COMMAND,0x5f01,0)==0" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "doc_font&&doc_font==reinterpret_cast(SendMessageW(debug,WM_GETFONT,0,0))" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "SendMessageW(h,BM_GETCHECK,0,0)==(phase==1?BST_CHECKED:BST_UNCHECKED)" (Indicator: "sendmessage"; Source: "sample.bin")27:T6f5,Found reference to API "GetWindowTextW(debug_hwnd,native_log.data(),int(native_log.size()))==int(unicode_log->size())&&std::wstring_view(native_log.data())==*unicode_log" (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API "GetWindowTextW(debug,v.data(),int(v.size()))==int(v.size()-1)" (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API "IsWindowVisible(main)&&IsWindowEnabled(main)&&GetActiveWindow()==main" (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API "GetWindowTextW(input.h,readback,0x104)==int(path.size())&&std::wstring_view(readback)==path" (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API "GetActiveWindow()==main&&GetFocus()==monitor" (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API "GetWindowTextW(doc,value.data(),int(value.size()))==length" (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API "GetWindowTextW(debug,old_debug.data(),int(old_debug.size()))==int(old_debug.size()-1)" (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API "GetFocus()==focus&&GetActiveWindow()==active" (Indicator: "GetActiveWindow"; Source: "sample.bin"), file/memory contains long string with (Indicator: "FindWindow"; Source: "sample.bin"), Found reference to API "GetWindowTextW(doc_hwnd,native_doc.data(),int(native_doc.size()))==int(document.text.size()) &&std::u16string_view(reinterpret_cast(native_doc.data()))==document.text" (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API "GetWindowTextW(edit,visible.data(),int(visible.size()))==int(expected_doc.size())&&std::wstring_view(visible.data())==expected_doc" (Indicator: "GetWindowText"; Source: "sample.bin")28:Tdde,Found registry query API: "RegOpenKeyExW(key,L"NewKeyConfigTable",0,KEY_READ,&keys)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved164)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,preset_path(i).c_str(),0,KEY_READ,&key)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,(key+L"\\MIDIPortMap0").c_str(),0,KEY_ALL_ACCESS,&preset_key)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved172)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved169)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,KEY_READ,&key)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved162)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,path.c_str(),0,KEY_READ,&key)==ERROR_FILE_NOT_FOUND&&!key" in "sample.bin", Found registry query API: "RegQueryValueExW(key,name,nullptr,&type,data.data(),&size)==ERROR_SUCCESS&&size==data.size()" in "sample.bin", Found registry query API: "RegOpenKeyExW(key,L"MIDIPortMap0",0,KEY_ALL_ACCESS,&preset)==ERROR_FILE_NOT_FOUND" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved174)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,key.c_str(),0,KEY_READ,&original)==ERROR_SUCCESS&&original" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved176)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegQueryValueExW(key,name,nullptr,&type,nullptr,&size)==ERROR_SUCCESS&&type==expected_type&&size==expected_size" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved185)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "depth<16&&RegQueryInfoKeyW(key,nullptr,nullptr,nullptr,&keys,&key_length,nullptr,&values,&value_length,&data_length,nullptr,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(classes.key,L"TMIDI Application",0,KEY_READ,&file_type)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved166)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,KEY_READ,&saved183)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,key.c_str(),0,KEY_ALL_ACCESS,&native_key)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegQueryValueExW(key,name,nullptr,&value.type,value.bytes.data(),&size)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,KEY_ALL_ACCESS,&key)==ERROR_SUCCESS" in "sample.bin", Found registry query API: "RegOpenKeyExW(key,L"MIDIPortMap0",0,KEY_ALL_ACCESS,&preset)==ERROR_SUCCESS" in "sample.bin"29:T5e4,Found registry deletion API: "RegDeleteTreeW(HKEY_CURRENT_USER,options.registry_subkey.c_str())==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegDeleteKeyW(HKEY_CURRENT_USER,key.c_str())==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegDeleteValueW(native_key,L"MIDITemplateMode")==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegDeleteTreeW(HKEY_CURRENT_USER,path.c_str())==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegDeleteTreeW(HKEY_CURRENT_USER,preset_key.c_str())==ERROR_SUCCESS&&RegCloseKey(key)==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegDeleteKeyW(HKEY_CURRENT_USER,(key+L"\\MIDIPortMap"+std::to_wstring(index)).c_str())==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegCloseKey(album)==0&&RegCloseKey(root)==0&&RegDeleteTreeW(HKEY_CURRENT_USER,options.registry_subkey.c_str())==0" in "sample.bin", Found registry deletion API: "RegDeleteKeyW(HKEY_CURRENT_USER,options.registry_subkey.c_str())==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegDeleteValueW(key,L"Filter")==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegDeleteTreeW(HKEY_CURRENT_USER,key.c_str())==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegDeleteValueW(key,L"SMFKFolder")==ERROR_SUCCESS" in "sample.bin", Found registry deletion API: "RegCloseKey(key)==ERROR_SUCCESS&&RegDeleteTreeW(HKEY_CURRENT_USER,options.registry_subkey.c_str())==ERROR_SUCCESS" in "sample.bin"2a:T1791,Found reference to API "read165(file165)==bytes165&&DeleteFileW(file165.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "DeleteFileW(registry_before_path185.c_str())&&DeleteFileW(registry_after_path185.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read170(file170)==bytes170&&DeleteFileW(file170.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read163(file163)==bytes163&&DeleteFileW(file163.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read162(file162)==bytes162&&DeleteFileW(file162.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read169(file169)==bytes169&&DeleteFileW(file169.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read176(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read176(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "SetWindowTextW(debug,old_debug.data())&&DeleteFileW(file.c_str())&&RemoveDirectoryW(root.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "SetWindowTextW(debug,old_debug.data())&&DeleteFileW(file.c_str())&&RemoveDirectoryW(root.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "DeleteFileW(registry_before_path184.c_str())&&DeleteFileW(registry_after_path184.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "DeleteFileW(registry_before_path183.c_str())&&DeleteFileW(registry_after_path183.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read185(file)==original&&read185(nbf_file)==nbf_bytes&&DeleteFileW(file.c_str())&&DeleteFileW(nbf_file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read185(file)==original&&read185(nbf_file)==nbf_bytes&&DeleteFileW(file.c_str())&&DeleteFileW(nbf_file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "read172(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read172(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "RemoveDirectoryW(root.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "read173(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read173(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "DeleteFileW(output.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read178(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read178(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "DeleteFileW(registry_before_path178.c_str())&&DeleteFileW(registry_after_path178.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read166(file166)==bytes166&&DeleteFileW(file166.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read180(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read180(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "DeleteFileW(file.c_str())&&!std::filesystem::exists(file)" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "read183(file)==original&&read183(nbf_file)==nbf_bytes&&DeleteFileW(file.c_str())&&DeleteFileW(nbf_file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read183(file)==original&&read183(nbf_file)==nbf_bytes&&DeleteFileW(file.c_str())&&DeleteFileW(nbf_file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin"), Found reference to API "DeleteFileW(registry_before_path180.c_str())&&DeleteFileW(registry_after_path180.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "DeleteFileW(own.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read175(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API "read175(file)==original&&DeleteFileW(file.c_str())&&std::filesystem::is_empty(directory)&&RemoveDirectoryW(directory.c_str())" (Indicator: "RemoveDirectory"; Source: "sample.bin")2b:Tfef,Found reference to API "RegCloseKey(key165)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved166)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd166&&!std::filesystem::exists(default166->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved184)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd184&&!std::filesystem::exists(default184->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved177)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd177&&!std::filesystem::exists(default177->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved170)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd170&&!std::filesystem::exists(default170->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS &&RegCopyTreeW(saved,nullptr,key)==ERROR_SUCCESS&&RegCloseKey(saved)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(keys)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved180)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd180&&!std::filesystem::exists(default180->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(fixed)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved169)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd169&&!std::filesystem::exists(default169->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved173)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd173&&!std::filesystem::exists(default173->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved174)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd174&&!std::filesystem::exists(default174->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(key170)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(key162)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved183)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd183&&!std::filesystem::exists(default183->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(root)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved176)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd176&&!std::filesystem::exists(default176->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegDeleteTreeW(HKEY_CURRENT_USER,preset_key.c_str())==ERROR_SUCCESS&&RegCloseKey(key)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(key169)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(association)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(preset)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved185)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd185&&!std::filesystem::exists(default185->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(saved178)==ERROR_SUCCESS&&std::filesystem::current_path()==cwd178&&!std::filesystem::exists(default178->path)" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "ReleaseDC(info,dc)&&DeleteObject(palette)&&RegCloseKey(key)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API "RegCloseKey(fixed163)==ERROR_SUCCESS" (Indicator: "RegCloseKey"; Source: "sample.bin")2c:T111d,Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS&&RegCopyTreeW(saved185,nullptr,key)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key163,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS&&RegCopyTreeW(saved172,nullptr,key)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS&&RegCopyTreeW(saved173,nullptr,key)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS &&RegCopyTreeW(saved,nullptr,key)==ERROR_SUCCESS&&RegCloseKey(saved)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,(key+L"\\MIDIPortMap2").c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&preset_key,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed164,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCopyTreeW(saved169,nullptr,key169)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed165,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCopyTreeW(saved162,nullptr,key162)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS&&RegCopyTreeW(saved178,nullptr,key)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS&&RegCopyTreeW(saved183,nullptr,key)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key170,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,path.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCopyTreeW(saved,nullptr,local)==ERROR_SUCCESS&&RegCloseKey(saved)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCopyTreeW(saved166,nullptr,key166)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCopyTreeW(saved163,nullptr,key163)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,key.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&local,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key169,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key,nullptr)==ERROR_SUCCESS&&RegCopyTreeW(saved174,nullptr,key)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCopyTreeW(saved170,nullptr,key170)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCreateKeyExW(root,L"Album",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&album,nullptr)==0" in "sample.bin", Found registry modification API: "RegCreateKeyExW(HKEY_CURRENT_USER,options.registry_subkey.c_str(),0,nullptr,0,KEY_ALL_ACCESS,nullptr,&key165,nullptr)==ERROR_SUCCESS" in "sample.bin", Found registry modification API: "RegCopyTreeW(saved165,nullptr,key165)==ERROR_SUCCESS" in "sample.bin"2d:T771,"RegOpenKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,KEY_READ,&key)==ERROR_SUCCESS" in Source: sample.bin, "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed164,nullptr)==ERROR_SUCCESS" in Source: sample.bin, "Software\Classes" in Source: sample.bin, "Software\Fummy\TMIDI Player" in Source: sample.bin, "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed165,nullptr)==ERROR_SUCCESS" in Source: sample.bin, "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed,nullptr)==ERROR_SUCCESS" in Source: sample.bin, "Software\Fummy\TMIDI Player\" in Source: sample.bin, "Software\TMIDI-Reborn\Checks\OriginalApplication-" in Source: sample.bin, "RegOpenKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,KEY_ALL_ACCESS,&key)==ERROR_SUCCESS" in Source: sample.bin, "\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" in Source: sample.bin, "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed163,nullptr)==ERROR_SUCCESS" in Source: sample.bin, "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed170,nullptr)==ERROR_SUCCESS" in Source: sample.bin, "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed166,nullptr)==ERROR_SUCCESS" in Source: sample.bin, "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed162,nullptr)==ERROR_SUCCESS" in Source: sample.bin, "RegCreateKeyExW(HKEY_CURRENT_USER,L"Software\\Fummy\\TMIDI Player",0,nullptr,0,KEY_ALL_ACCESS,nullptr,&fixed169,nullptr)==ERROR_SUCCESS" in Source: sample.bin, "Software\Fummy\TMIDI Player\MIDIPortMap" in Source: sample.bin2e:T7dd,Found reference to API "GetWindowThreadProcessId(h,&owner_pid)==thread&&owner_pid==pid" (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API "IsWindow(h)&&GetWindowThreadProcessId(h,&p)==thread&&p==pid&&AreDpiAwarenessContextsEqual(GetWindowDpiAwarenessContext(h),DPI_AWARENESS_CONTEXT_UNAWARE_GDISCALED)&&GetDpiForWindow(h)==96" (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API "GetWindowThreadProcessId(h,&owner_pid)==thread&&owner_pid==pid&&AreDpiAwarenessContextsEqual(GetWindowDpiAwarenessContext(h),DPI_AWARENESS_CONTEXT_UNAWARE_GDISCALED)&&GetDpiForWindow(h)==96" (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API "DdeQueryConvInfo(conversation,QID_SYNC,&info)&&GetWindowThreadProcessId(info.hwndPartner,&pid)&&pid==GetCurrentProcessId()" (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API "GetWindowThreadProcessId(h,&pid)&&pid==GetCurrentProcessId()" (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API "h&&IsWindow(h)&&GetWindowThreadProcessId(h,&p)==thread&&p==pid &&AreDpiAwarenessContextsEqual(GetWindowDpiAwarenessContext(h),DPI_AWARENESS_CONTEXT_UNAWARE_GDISCALED)&&GetDpiForWindow(h)==96" (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API "h&&IsWindow(h)&&GetWindowThreadProcessId(h,&actual)==thread&&actual==pid&&GetDpiForWindow(h)==96&&std::find(modal.begin(),modal.end(),h)==modal.end()" (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API "h&&IsWindow(h)&&GetWindowThreadProcessId(h,&p)==thread&&p==pid &&AreDpiAwarenessContextsEqual(GetWindowDpiAwarenessContext(h),DPI_AWARENESS_CONTEXT_UNAWARE_GDISCALED)&&GetDpiForWindow(h)==96 &&std::find(modal.begin(),modal.end(),h)==modal.end()" (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin")2f:Te8f,Heuristic match: "getmenu(main)&&(getwindowlongptrw(main,gwl_style)&ws_dlgframe)&&with_bar.bottom-with_bar.top>bare.bottom-bare.top", Heuristic match: "getclientrect(wrd_hwnd,&client)&&!client.left&&!client.top", Heuristic match: "app.playlist().size()==2&&app.playlist_state().current==1&&app.history()==history&&!timer.id", Heuristic match: "app.midi_owner().graph()==graph&&!app.engine().reader&&!timer.id", Pattern match: "e.tick/192", Heuristic match: "grown_width<=monitor.rcwork.right-monitor.rcwork.left&&grown_height<=monitor.rcwork.bottom-monitor.rcwork.top", Heuristic match: "app.playlist().size()==size+1&&app.playlist().slot(size).module.empty()&&app.engine().reader&&timer.id", Heuristic match: "app.engine().reader&&timer.id", Heuristic match: "contents[i]->cached_geometry.width==r.right-r.left&&contents[i]->cached_geometry.height==r.bottom-r.top", Heuristic match: "sequence->playing&&engine.timer&&timer.id", Heuristic match: "app.playlist().size()==size&&!app.engine().reader&&!timer.id", Heuristic match: "app.midi_owner().graph()==graph&&app.engine().reader&&timer.id&&gate.raw_id==timer.id", Heuristic match: "sequence&&clock&&reader&&app.engine().status==sequence&&sequence->playing&&!sequence->paused&&input->defer_flush==1 &&app.playlist_state().running&&!app.playlist_state().paused&&timer.id&&gate.raw_id==timer.id", Heuristic match: "app.engine().reader==reader&&app.engine().reader_state==sequence&&app.engine().timer==timer_owner &&app.midi_owner().loader()->reader_owner()==reader_owner&&reader_owner->raw_backing().data()==backing.data()&&timer.id&&gate.raw_id==timer.id", Heuristic match: "app.midi_owner().graph()==graph&&app.engine().reader==reader&&app.engine().reader_state==sequence&&app.midi_owner().loader()->reader_owner()==owner&&timer.id&&gate.raw_id==timer.id", Heuristic match: "width>0&&height>0&&width+80<=monitor.rcwork.right-monitor.rcwork.left&&height+81<=monitor.rcwork.bottom-monitor.rcwork.top", Heuristic match: "id==t.id", Heuristic match: "w==a.position&&getmenuitemid(reinterpret_cast(l),uint(w))==a.id", Heuristic match: "dirty.left>=1&&dirty.top>=1&&dirty.right<=130&&dirty.bottom<=67&&dirty.right>dirty.left&&dirty.bottom>dirty.top", Heuristic match: "start.rect.right>start.rect.left&&start.rect.bottom>start.rect.top", Heuristic match: "app.playlist().size()==2&&app.playlist_state().current==1&&!app.engine().reader&&!timer.id", Heuristic match: "sequence&&reader&&timer_owner&&input->defer_flush==1&&!sequence->paused&&timer.id&&gate.raw_id==timer.id", Heuristic match: "mailto:fummy@md.neweb.ne.jp", Heuristic match: "cached.width==wrd_outer.right-wrd_outer.left&&cached.height==wrd_outer.bottom-wrd_outer.top", Heuristic match: "engine.reader&&timer.id", Heuristic match: "sequence&&reader&&reader_owner&&reader_owner->smf()&&clock&&timer.id&&gate.raw_id==timer.id", Heuristic match: "!app.playlist().size()&&!timer.id", Heuristic match: "getwindowrect(main,&outer)&&getclientrect(wrd_hwnd,&grown_client) &&outer.left>=monitor.rcwork.left&&outer.top>=monitor.rcwork.top&&outer.right<=monitor.rcwork.right&&outer.bottom<=monitor.rcwork.bottom &&outer.right-outer.left==grown_width&&outer.bottom-o", Heuristic match: "sequence&&reader&&reader_owner&&reader_owner->smf()&&clock&&profiles&&timer.id&&gate.raw_id==timer.id", Pattern match: "http://www.vector.co.jp/authors/va010012/", Heuristic match: "engine.reader&&engine.timer&&engine.reader_state&&timer.id", Heuristic match: "!sequence->paused&&sequence->playing&&timer.id&&gate.raw_id==timer.id", Heuristic match: "app.playlist().size()==1&&!app.playlist_state().running&&!timer.id", Heuristic match: "app.playlist().size()==2&&app.playlist_state().current==1&&app.playlist_state().running&&timer.id"30:T7e0,Found reference to API "RegSetValueExW(key,name,0,type,static_cast(data),size)==ERROR_SUCCESS" (Indicator: "RegSetValue"; Source: "sample.bin"), Found reference to API "RegSetValueExW(native_key,L"FrameMode",0,REG_BINARY,independent.data(),DWORD(independent.size()))==ERROR_SUCCESS" (Indicator: "RegSetValue"; Source: "sample.bin"), Found reference to API "RegOverridePredefKey(HKEY_CURRENT_USER,nullptr)==ERROR_SUCCESS" (Indicator: "RegOverridePredefKey"; Source: "sample.bin"), Found reference to API "RegOverridePredefKey(predefined,key)==ERROR_SUCCESS" (Indicator: "RegOverridePredefKey"; Source: "sample.bin"), Found reference to API "RegSetValueExW(native_key,L"TrayIcon",0,REG_DWORD,reinterpret_cast(&zero),4)==ERROR_SUCCESS" (Indicator: "RegSetValue"; Source: "sample.bin"), Found reference to API "RegSetKeySecurity(key,DACL_SECURITY_INFORMATION,reinterpret_cast(security.data()))==ERROR_SUCCESS" (Indicator: "RegSetKeySecurity"; Source: "sample.bin"), Found reference to API "RegSetValueExW(native_key,L"WindowMode",0,REG_DWORD,reinterpret_cast(&small_mode),4)==ERROR_SUCCESS" (Indicator: "RegSetValue"; Source: "sample.bin"), Found reference to API "RegOverridePredefKey(predefined,nullptr)==ERROR_SUCCESS" (Indicator: "RegOverridePredefKey"; Source: "sample.bin"), Found reference to API "RegSetKeySecurity(key,DACL_SECURITY_INFORMATION,&restricted)==ERROR_SUCCESS" (Indicator: "RegSetKeySecurity"; Source: "sample.bin"), Found reference to API "RegSetValueExW(native_key,name,0,REG_DWORD,reinterpret_cast(&value),4)==ERROR_SUCCESS" (Indicator: "RegSetValue"; Source: "sample.bin"), Found reference to API "RegSetValueExW(native_key,L"DocFont",0,REG_SZ,reinterpret_cast(face.c_str()),DWORD((face.size()+1)*2))==ERROR_SUCCESS" (Indicator: "RegSetValue"; Source: "sample.bin"), Found reference to API "RegOverridePredefKey(HKEY_CURRENT_USER,key)==ERROR_SUCCESS" (Indicator: "RegOverridePredefKey"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample ebd504d5b2b6… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample ebd504d5b2b6…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/ebd504d5b2b67b8c4339d0cead03c412cacac7be79ab48a69290133295a72364\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"ebd504d5b2b67b8c4339d0cead03c412cacac7be79ab48a69290133295a72364\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"original_application_check-alices8.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"executable\"],\"identifier\":\"ebd504d5b2b67b8c4339d0cead03c412cacac7be79ab48a69290133295a72364\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":24},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"ebd504d5b2b67b8c4339d0cead03c412cacac7be79ab48a69290133295a72364","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792829596487,"unified_at":"2026-10-24T08:13:16.487Z","metadata":{"hashes":{"sha256":"ebd504d5b2b67b8c4339d0cead03c412cacac7be79ab48a69290133295a72364","sha1":"6e0f14f4bc1ae109461a6e9914d365d0db14a2a4","md5":"0c91cc322aaae50d32787602c0296801"},"file_info":{"file_name":"original_application_check-alices8.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":6609920,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792829563000,"last_seen":1792829563000,"last_multi_scan":1792829563000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":23},"sandbox_signatures":{"informative_count":35,"suspicious_count":0,"malicious_count":0,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$26","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW(MonitorFromWindow(host,MONITOR_DEFAULTTONEAREST),&monitor)&&(monitor.dwFlags&MONITORINFOF_PRIMARY)\" in \"sample.bin\", Found system information discovery API: \"GetMonitorInfoW(MonitorFromWindow(main,MONITOR_DEFAULTTONEAREST),&monitor)&&(monitor.dwFlags&MONITORINFOF_PRIMARY)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"file/memory contains long string with (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname(socket,reinterpret_cast(&address),&n)==0\" (Indicator: \"getsockname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-224","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt(target,0,0,client.right,client.bottom,source,0,0,SRCCOPY)&&GdiFlush()\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"BitBlt(captured.dc,0,0,131,68,dc,0,0,SRCCOPY)\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"BitBlt(captured.dc,0,0,131,20,dc,0,0,SRCCOPY)\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"BitBlt(captured.dc,0,0,131,20,dc,0,0,SRCCOPY)&&ReleaseDC(led,dc)==1\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"BitBlt(target,0,0,client.right,client.bottom,source_dc,0,0,SRCCOPY)&&GdiFlush()\" (Indicator: \"BitBlt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW(sidecar.c_str())==INVALID_FILE_ATTRIBUTES\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS|GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,reinterpret_cast(procedure),&module)\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"DdeQueryConvInfo(conversation,QID_SYNC,&info)&&GetWindowThreadProcessId(info.hwndPartner,&pid)&&pid==GetCurrentProcessId()\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId(h,&pid)&&pid==GetCurrentProcessId()\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS|GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,reinterpret_cast(procedure),&module)\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState(saved_keys.data())\" (Indicator: \"GetKeyboardState\"; Source: \"sample.bin\"), Found reference to API \"(GetKeyState(VK_SHIFT)&0x8000)==0&&(GetKeyState(VK_CONTROL)&0x8000)==0&&(GetKeyState(VK_MENU)&0x8000)==0\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \" [PAUSE]\" (Indicator: \"[pause]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64()(&timeout),sizeof(timeout))==0\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"setsockopt(socket,SOL_SOCKET,SO_EXCLUSIVEADDRUSE,reinterpret_cast(&exclusive),sizeof(exclusive))==0\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt(peer,SOL_SOCKET,SO_RCVTIMEO,reinterpret_cast(&timeout),sizeof(timeout))==0\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"setsockopt(socket,SOL_SOCKET,SO_EXCLUSIVEADDRUSE,reinterpret_cast(&exclusive),sizeof(exclusive))==0\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSACleanup()==0\" (Indicator: \"wsacleanup\"; Source: \"sample.bin\"), Found reference to API \"WSAStartup(0x0202,&data)==0\" (Indicator: \"wsastartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup(0x0202,&data)==0\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup(0x0202,&data)==0\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$30","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64()