24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 85:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_60% Sample e640a65efcae… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e640a65efcae…. Malware family: Win/grayware_confidence_60%. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a","keywords":["Malicious","Win/grayware_confidence_60%","malware analysis","sandbox report","threat intelligence","e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a"],"about":{"@type":"SoftwareApplication","name":"SamFwToolSetup.exe","applicationCategory":["peexe","executable"],"identifier":"e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_60%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7d2,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")26:T628,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")27:T146e,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtSetTimer" (Indicator: "SetTimer"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000000.170731.72727000.00000002.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp")28:T994,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")29:T8f9,"" (Indicator: "enumchildwindows"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000000.170731.72727000.00000002.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000000.170731.72727000.00000002.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00008108.00000000.173218.02F30000.00000004.mdmp, 00000000-00008108.00000001.173896.02F30000.00000004.mdmp")32:T466,"" (Indicator: "GetDC"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000000.170731.72727000.00000002.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00004912.00000001.172650.726C1000.00000020.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008108.00000000.173218.02F30000.00000004.mdmp, 00000000-00008108.00000001.173896.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008108.00000000.173218.02F30000.00000004.mdmp, 00000000-00008108.00000001.173896.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008108.00000000.173218.02F30000.00000004.mdmp, 00000000-00008108.00000001.173896.02F30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008108.00000000.173218.02F30000.00000004.mdmp, 00000000-00008108.00000001.173896.02F30000.00000004.mdmp")6b:T4ec,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "5016309217,3568,3118,,FindFirstFileW,kernel32.dll,"00:44:49.546",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")6c:Te0b,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetConsoleProcessList" (Indicator: "ProcessList"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")6d:T564,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")6e:T10b4,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQueryAttributesFile" (Indicator: "QueryAttributesFile"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004912.00000002.172996.006E0000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")6f:T400,Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00004912.00000000.170731.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.06320000.00000004.mdmp") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00004912.00000000.170731.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.06320000.00000004.mdmp") Found string "Where should SamFw Tool be installed?" (Indicator: "where "; Source: "00000000-00004912.00000000.170731.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.04EF0000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00005588.00000001.172561.04D30000.00000004.mdmp") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00005588.00000001.172561.04D30000.00000004.mdmp")70:Taef,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQuerySecurityObject" (Indicator: "NtQuerySecurityObject"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")71:Tcff,file/memory contains long string with (Indicator: "password"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") file/memory contains long string with (Indicator: "password"; File: "00000000-00005588.00000001.172561.00401000.00000020.mdmp") Found string "Can not open encrypted archive. Wrong password?" (Indicator: "password"; File: "00000000-00000032.00000000.172299.00401000.00000020.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; File: "00000000-00000032.00000000.172299.00401000.00000020.mdmp") Found string "Headers Error in encrypted archive. Wrong password?" (Indicator: "password"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found string "Wrong password" (Indicator: "password"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found string "Data Error in encrypted file. Wrong password?" (Indicator: "password"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found string "CRC Failed in encrypted file. Wrong password?" (Indicator: "password"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found string "Can not open encrypted archive. Wrong password?" (Indicator: "password"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found string "Enter password (will not be echoed):" (Indicator: "password"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00004912.00000000.170731.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.06320000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00004912.00000000.170731.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.06320000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00004912.00000000.170731.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.04EF0000.00000004.mdmp, 00000000-00004912.00000001.172650.06320000.00000004.mdmp") Found string "$Credential without user and password+Platform-dependant function not implemented)Scheme-dependant function not implemented" (Indicator: "password"; Source: "00000000-00004912.00000002.172996.006E0000.00000002.mdmp") Found string "/PASSWORD=password" (Indicator: "password"; Source: "00000000-00005588.00000001.172561.00401000.00000020.mdmp") Found string "Specifies the password to use." (Indicator: "password"; Source: "00000000-00005588.00000001.172561.00401000.00000020.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00005588.00000001.172561.04D30000.00000004.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00005588.00000001.172561.04D30000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00005588.00000001.172561.04D30000.00000004.mdmp")72:Td7a,Found string "C:\SamFwTool\data\drivers\amd64" (Indicator: "\drivers\"; Source: "00000000-00004912-00000C3F-44260595698") Found string "C:\SamFwTool\data\drivers\x86" (Indicator: "\drivers\"; Source: "00000000-00004912-00000C3F-44261452262") Found string "C:\SamFwTool\data\drivers\SAMSUNG_Android.cat" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-1301080982") Found string "\\?\C:\SamFwTool\data\drivers\SAMSUNG_Android.cat" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-1302028910") Found string "C:\SamFwTool\data\drivers\SAMSUNG_Android.inf" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-1308044694") Found string "\\?\C:\SamFwTool\data\drivers\SAMSUNG_Android.inf" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-1309004116") Found string "C:\SamFwTool\data\drivers\amd64\libusb-1.0_x86.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3196426241") Found string "\\?\C:\SamFwTool\data\drivers\amd64\libusb-1.0_x86.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3197136009") Found string "C:\SamFwTool\data\drivers\amd64\libusb0.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3203093932") Found string "\\?\C:\SamFwTool\data\drivers\amd64\libusb0.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3203776258") Found string "C:\SamFwTool\data\drivers\amd64\libusb0.sys" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3209388525") Found string "\\?\C:\SamFwTool\data\drivers\amd64\libusb0.sys" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3210064727") Found string "C:\SamFwTool\data\drivers\amd64\libusb0_x86.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3215283305") Found string "\\?\C:\SamFwTool\data\drivers\amd64\libusb0_x86.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3215943143") Found string "C:\SamFwTool\data\drivers\amd64\libusbK.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3221175519") Found string "\\?\C:\SamFwTool\data\drivers\amd64\libusbK.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3221859011") Found string "C:\SamFwTool\data\drivers\amd64\libusbK.sys" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3248343754") Found string "\\?\C:\SamFwTool\data\drivers\amd64\libusbK.sys" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3249011088") Found string "C:\SamFwTool\data\drivers\amd64\libusbK_x86.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3255185898") Found string "\\?\C:\SamFwTool\data\drivers\amd64\libusbK_x86.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3255923728") Found string "C:\SamFwTool\data\drivers\amd64\WdfCoInstaller01009.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3262035556") Found string "\\?\C:\SamFwTool\data\drivers\amd64\WdfCoInstaller01009.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3262713900") Found string "C:\SamFwTool\data\drivers\amd64\winusbcoinstaller2.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3310367473") Found string "\\?\C:\SamFwTool\data\drivers\amd64\winusbcoinstaller2.dll" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3311051481") Found string "C:\SamFwTool\data\drivers\install_x64.exe" (Indicator: "\drivers\"; Source: "00000000-00000032-00000C2E-3374610801")73:T488,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "100113111637,5548,3137,,RemoveDirectoryW,kernel32.dll,"00:45:03.250",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00005588.00000002.173018.02D60000.00000004.mdmp")74:T692,Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000000.170731.72727000.00000002.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000000.170731.72727000.00000002.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00004912.00000000.170731.006D6000.00000004.mdmp, 00000000-00004912.00000000.170731.72727000.00000002.mdmp, 00000000-00004912.00000001.172650.006D6000.00000004.mdmp, 00000000-00004912.00000002.172996.006D6000.00000004.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; Source: "00000000-00004912.00000000.170731.72727000.00000002.mdmp")75:T753,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005588.00000001.172561.00401000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005884.00000000.173248.05320000.00000004.mdmp, 00000000-00005884.00000001.173352.05320000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00008108.00000000.173218.02F30000.00000004.mdmp, 00000000-00008108.00000000.173218.04F70000.00000004.mdmp, 00000000-00008108.00000001.173896.02F30000.00000004.mdmp, 00000000-00008108.00000001.173896.04F70000.00000004.mdmp")76:T1045,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtAccessCheck" (Indicator: "AccessCheck"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlCopySid" (Indicator: "CopySid"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtDuplicateToken" (Indicator: "DuplicateToken"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtPrivilegeCheck" (Indicator: "PrivilegeCheck"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlAddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlInitializeSid" (Indicator: "InitializeSid"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlGetAce" (Indicator: "GetAce"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAce"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlAddAccessAllowedAceEx" (Indicator: "AddAccessAllowedAceEx"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAce"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlAddAccessDeniedAceEx" (Indicator: "AddAccessDeniedAceEx"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlEqualPrefixSid" (Indicator: "EqualPrefixSid"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "NtAllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "RtlEqualSid" (Indicator: "EqualSid"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004912.00000002.172996.006E0000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00004912.00000002.172996.006E0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004912.00000002.172996.006E0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004912.00000002.172996.006E0000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp")77:T504,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "00000000-00000032.00000000.172299.00401000.00000020.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; File: "00000000-00000032.00000000.172299.00401000.00000020.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "00000000-00000032.00000000.172299.00401000.00000020.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "00000000-00000032.00000000.172299.00401000.00000020.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp, 00000000-00000032.00000000.172299.02AF0000.00000004.mdmp") Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00000032.00000000.172299.00495000.00000002.mdmp")78:T1960,Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin] Observed import api "AccessCheck" which can "determine whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: cygwin1.dll] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: cygwin1.dll] Observed import api "AddAccessAllowedAceEx" which can "add an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL)" [Source: cygwin1.dll] Observed import api "AddAccessDeniedAce" which can "add an access-denied access control entry (ACE) to an access control list (ACL)" [Source: cygwin1.dll] Observed import api "AddAccessDeniedAceEx" which can "add an access-denied access control entry (ACE) to the end of a discretionary access control list (DACL)" [Source: cygwin1.dll] Observed import api "AllocateLocallyUniqueId" which can "allocate a locally unique identifier (LUID)" [Source: cygwin1.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: cygwin1.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: cygwin1.dll] Observed import api "EqualPrefixSid" which can "test two security-identifier (SID) prefix values for equality" [Source: cygwin1.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: cygwin1.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: cygwin1.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: cygwin1.dll] Observed import api "PrivilegeCheck" which can "determine whether a specified set of privileges are enabled in an access token" [Source: cygwin1.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: 7zax64.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: 7zax64.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: install_x64.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: install_x64.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: install_x64.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: install_x64.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: install_x86.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: install_x86.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: install_x86.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: install_x86.exe] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: 7z.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: 7z.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: libusb0.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: libusb0.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: libusb0.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: libusb0.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: libusb0_x86.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: libusb0_x86.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: libusb0_x86.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: libusb0_x86.dll]79:T466,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000032.00000000.172299.02AF0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004912.00000000.170731.72727000.00000002.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005588.00000000.170642.004B7000.00000004.mdmp, 00000000-00005588.00000002.173018.004B7000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008108.00000000.173218.02F30000.00000004.mdmp, 00000000-00008108.00000001.173896.02F30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000032.00000000.172299.00495000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"RC2a\" (Indicator: \"RC2\"; Source: \"00000000-00000032.00000000.172299.00495000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004912.00000002.172996.006E0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\" Microsoft Corporation\"\n \"fld.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"recovery.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"qs.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"libusbK.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"AdbWinApi.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"libusb0_x86.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"AdbWinUsbApi.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002812.00000000.189107.01950000.00000004.mdmp\n 00000000-00002812.00000001.189323.01950000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00006824-4856-4140-004AFDB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":20,"imported_dlls_count":94,"dropped_files_count":0,"extracted_files_count":37,"files_written_count":78,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"sandbox_reports":[{"id":"699b6170aeb56201400fdf5e","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"PUP.Packunwan.mz","submit_name":"SamFwToolSetup.exe","analysis_start_time":"2026-02-22T20:05:10+00:00","indicators_count":{"informative":283,"suspicious":63,"malicious":3},"tags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"699807500e5b2384d1066e20","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"PUP.Packunwan.mz","submit_name":"e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin","analysis_start_time":"2026-02-20T07:03:50+00:00","indicators_count":{"informative":278,"suspicious":58,"malicious":4},"tags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}],"processes":[{"pid":5588,"ppid":0,"name":"e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.exe","command_line":"","sha256":"e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a","normalized_path":"C:\\e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.exe","uid":"00000000-00005588","icon":"$82"},{"pid":4912,"ppid":5588,"name":"e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp","command_line":"/SL5=\"$3032A,48449625,832512,C:\\e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.exe\"","sha256":"454709304d52faeb9c26a91a659aeaf33add66a1af3889791e0be456b201d0ae","normalized_path":"%TEMP%\\is-Q8MC1.tmp\\e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp","parent_uid":"00000000-00005588","uid":"00000000-00004912"},{"pid":32,"ppid":4912,"name":"7za.exe","command_line":"x \"C:\\SamFwTool\\data.7z\" -o\"C:\\SamFwTool\\\" * -r -aoa","sha256":"e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4","normalized_path":"C:\\SamFwTool\\data\\7za.exe","parent_uid":"00000000-00004912","uid":"00000000-00000032"},{"pid":8108,"ppid":4912,"name":"SamFwTool.exe","command_line":"","sha256":"7bd9223fce3c81eb751d34ae8489f1c3669e31c3dbaf7520e14b04ad4dfad925","normalized_path":"C:\\SamFwTool\\SamFwTool.exe","parent_uid":"00000000-00004912","uid":"00000000-00008108"},{"pid":6592,"ppid":8108,"name":"WerFault.exe","command_line":"-u -p 8108 -s 868","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008108","uid":"00000000-00006592"},{"pid":6620,"ppid":8108,"name":"WerFault.exe","command_line":"-u -p 8108 -s 868","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008108","uid":"00000000-00006620"},{"pid":5884,"ppid":4912,"name":"SamFwTool.exe","command_line":"","sha256":"7bd9223fce3c81eb751d34ae8489f1c3669e31c3dbaf7520e14b04ad4dfad925","normalized_path":"C:\\SamFwTool\\SamFwTool.exe","parent_uid":"00000000-00004912","uid":"00000000-00005884"},{"pid":6780,"ppid":5884,"name":"WerFault.exe","command_line":"-u -p 5884 -s 820","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005884","uid":"00000000-00006780"},{"pid":944,"ppid":5884,"name":"WerFault.exe","command_line":"-u -p 5884 -s 820","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005884","uid":"00000000-00000944"},{"pid":7864,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 5884 -ip 5884","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007864","icon":"$83"},{"pid":8112,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 8108 -ip 8108","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008112","icon":"$84"}],"all_imported_dlls":["SHCore.dll","CoreUIComponents.dll","mscorlib.ni.dll","System.Core.ni.dll","System.Drawing.dll","user32.dll","cryptbase.dll","ntshrui.dll","KernelBase.dll","imm32.dll","ExplorerFrame.dll","mscoree.dll","sechost.dll","bcryptprimitives.dll","gdi32.dll","netapi32.dll","winhttp.dll","ncrypt.dll","Windows.Globalization.dll","sfc_os.dll","ntdll.dll","wow64.dll","rpcrt4.dll","netutils.dll","cfgmgr32.dll","kernel.appcore.dll","shfolder.dll","BCP47Langs.dll","msvcp_win.dll","wtsapi32.dll","ntasn1.dll","sfc.dll","srvcli.dll","cscapi.dll","clrjit.dll","kernel32.dll","comctl32.dll","msvcrt.dll","aepic.dll","setupapi.dll","propsys.dll","mscoreei.dll","clr.dll","VxSSL32.dll","ws2_32.dll","sspicli.dll","ole32.dll","windows.storage.dll","clbcatq.dll","vcruntime140_clr0400.dll","fltLib.dll","apphelp.dll","linkinfo.dll","System.Windows.Forms.dll","advapi32.dll","win32u.dll","cryptsp.dll","shell32.dll","powrprof.dll","dwmapi.dll","CoreMessaging.dll","gdi32full.dll","shlwapi.dll","msctf.dll","winsta.dll","ntmarta.dll","globinputhost.dll","System.ni.dll","oleaut32.dll","bcrypt.dll","wow64cpu.dll","comdlg32.dll","TextInputFramework.dll","RstrtMgr.dll","tiptsf.dll","ucrtbase_clr0400.dll","diasymreader.dll","uxtheme.dll","WinTypes.dll","profapi.dll","mpr.dll","ucrtbase.dll","combase.dll","samcli.dll","msftedit.dll","cldapi.dll","psapi.dll","wow64win.dll","version.dll","wow64con.dll","TextShaping.dll","ServicingCommon.dll","wow64base.dll","Windows.UI.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp","sha256":"454709304d52faeb9c26a91a659aeaf33add66a1af3889791e0be456b201d0ae","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"LGUP_Cmd.exe","sha256":"fe50fd00bc9864440a2e7239de9d7c2fec9a119563ff7e7de9876fe777e1ab6d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"LGUP_Common.dll","sha256":"3df81327c652f19dfd5ca975ead7ffab996377b9b48acf7910f596c33955bb53","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"adb.exe","sha256":"ae5a372e7258332a60d9a0317f1e844fda3b88ddd0860bd231005e31d74482db","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"d.exe","sha256":"79511902128d2431e70db0f96e3386eb374ed397673adcb02dc25425ffb34b6b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"fastboot.exe","sha256":"0b00a50eafc5d5835ca741f30a2eee94f895087bd9f241be8a43b0c1548f058b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"fld.exe","sha256":"dea55ec366c9b9a85c6b16b91b6796d8bace3c834850d7307ae17cacb91c5145","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"7z.exe","sha256":"254cf6411d38903b2440819f7e0a847f0cfee7f8096cfad9e90fea62f42b0c23","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"7zax64.exe","sha256":"f558dfbb7f2bf5d9a002ac68843a2e79e4ec045edd7f56213562acfa75cc77ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"adbsl.exe","sha256":"474afa504d9d590936852cdc299ebaa89649d1f605d73ad2bea1a7f11dc200cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"cygwin1.dll","sha256":"aa4e55537722731c64a3ec520d63b02291d8640178c5129df2c1c5c4e8f9c90e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"linux-adk.exe","sha256":"7818468c19dbd4746e43b9df2f4d25f571ffcbf45a8b0202351dd4969af4c29c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"libusbK.dll","sha256":"fe26c89b5851b3807b9000cf2ffd6e4083e2f567a4019b5a57aeb9b976064cf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"install_x64.exe","sha256":"3bc113af70aed926190db4cf3766aa9219ba158995b71aae91c51f099f0776b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"install_x86.exe","sha256":"2e114a6aece017a9228b4a851d1279fdf47636c2866e0d858ac6a9c46c262971","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"lg.exe","sha256":"d8d39ac50db058734a068ab47370766dfac2997ea591ce509311732be5dea911","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"lg_misc.bin","sha256":"e0c5807f453acdb2fbe9ef2bdd5815b301b3855024044607b2d2e461796f3e1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"qs.exe","sha256":"42a5cdd3daa1798099625962a569a72656f28dd7d408be0e532bb12ee35ec4aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"recovery.exe","sha256":"59b7c05a739d2c1e0a5a4bf15497eed0fae2da4e9b22a1d2afcac04bf8b0b246","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"cyggcc_s-1.dll","sha256":"6e928df3452d150df15308977fe24f7c004e49f9d73070313029ec330c06f51c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"cygusb-1.0.dll","sha256":"b455cecb7badb3238647b93e8ea8e6eea839a525e1e88a88c78e6aad5e17df47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"libusb-1.0_x86.dll","sha256":"87cbd1f3bf5ab72089a879df110263784602a574c0ae83f428df57ae2f8115db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"libusbK_x86.dll","sha256":"87cbd1f3bf5ab72089a879df110263784602a574c0ae83f428df57ae2f8115db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"frp.bin","sha256":"e8a17a001d62039b8cbb579e5423d3cd699d933e8ba60b437a0b654681c62f4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"SamFw Tool.lnk","sha256":"59bae5183cd13e80b2fdf4131dec7cfd3bebe8697ee75c479a276267a0089e4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"_setup64.tmp","sha256":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"AdbWinApi.dll","sha256":"d60103a5e99bc9888f786ee916f5d6e45493c3247972cb053833803de7e95cf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"AdbWinUsbApi.dll","sha256":"25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"FacRst.apk","sha256":"ee3d62ff1d391afea4ef1f7f1584797399b6b7e018e22e76e2b50c97b0614e4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"L.apk","sha256":"6fba22d5877736cb238bbe6d39a090587055871e851b3f28f0c3dde8f5c5880a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"binary1","sha256":"e108a99468741e5a25951a4936686a8a6d36adcbcf1173ca0fbd44c73e372b61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"binary2","sha256":"3c88b8378317cd0eac19173b97a85a8837264fdcf07306320d35c705f5234abf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"SAMSUNG_Android.cat","sha256":"85ba931146c43fa69aa9f07c49997397763f3f77b64f127220291821730adbf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"SAMSUNG_Android.inf","sha256":"88a17acd388b46b0a3cf403519a1a93e8215d2ceecf68c4a59cf4796327b36fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"libusb0.dll","sha256":"535b9a18d18e6c15f7b2d9e183a274a52b6ed13e87eca963c501fbac445e22f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"libusb0_x86.dll","sha256":"3b8c37db1af7f30a2baff39b587ecf7edd30027ee3e91d5e596e39dd0f0e3908","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"SamFwToolSetup.tmp","sha256":"454709304d52faeb9c26a91a659aeaf33add66a1af3889791e0be456b201d0ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%TEMP%\\is-Q8MC1.tmp\\e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a.bin.tmp","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%USERPROFILE%\\Saved Games","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%TEMP%\\is-LPI08.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"path":"C:\\SamFwTool\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\is-FT0KD.tmp","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"path":"C:\\SamFwTool\\is-CUGEG.tmp","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"path":"C:\\SamFwTool\\is-IK8R8.tmp","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"path":"C:\\SamFwTool\\data\\is-CQPE4.tmp","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"path":"C:\\SamFwTool\\is-2N5CS.tmp","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\SamFw Tool.lnk","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%PUBLIC%\\Desktop\\SamFw Tool.lnk","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\bin","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\x86","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\fix.tar","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\SAMSUNG_Android.cat","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\SAMSUNG_Android.inf","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\FacRst.apk","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\f_part","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\L.apk","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\lg_misc.bin","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\mtk_module.data","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\samfw-protocol.apk","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\frp.bin","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\binary1","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\binary2","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\7z.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\7zax64.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\adb.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\adbsl.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\AdbWinApi.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\AdbWinUsbApi.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\bin\\cyggcc_s-1.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\bin\\cygusb-1.0.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\bin\\cygwin1.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\bin\\linux-adk.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\d.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\libusb-1.0_x86.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\libusb0.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\libusb0.sys","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\libusb0_x86.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\libusbK.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\libusbK.sys","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\libusbK_x86.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\WdfCoInstaller01009.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\amd64\\winusbcoinstaller2.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\install_x64.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\install_x86.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\x86\\libusb0.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\x86\\libusb0.sys","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\x86\\libusb0_x86.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\x86\\libusbK.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\x86\\libusbK.sys","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\x86\\WdfCoInstaller01009.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\drivers\\x86\\winusbcoinstaller2.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\fastboot.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\fld.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\lg.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\LGUP_Cmd.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\LGUP_Common.dll","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\qs.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\recovery.exe","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%TEMP%\\is-64NMI.tmp\\SamFwToolSetup.tmp","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"%TEMP%\\is-TK1DJ.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\is-6HSEF.tmp","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\is-5OD4V.tmp","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\is-U9OGQ.tmp","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\data\\is-ENGK9.tmp","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"path":"C:\\SamFwTool\\is-OVDES.tmp","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5588:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5588:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"SM0:5588:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"Local\\SM0:5588:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4912:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4912:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"SM0:4912:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"Local\\SM0:4912:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"699807500e5b2384d1066e20"},{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5276:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5276:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"SM0:5276:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"Local\\SM0:5276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"Local\\SM0:5276:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]},{"name":"Local\\SM0:6952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699b6170aeb56201400fdf5e"}]}]}},"report_ids":{"sandbox_job_ids":["699807500e5b2384d1066e20","699b6170aeb56201400fdf5e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/grayware_confidence_60% Sample e640a65efcae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e640a65efcae…. Malware family: Win/grayware_confidence_60%. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_60% Sample e640a65efcae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e640a65efcae…. Malware family: Win/grayware_confidence_60%. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e640a65efcae264ad6f758bb3b9da0d37ed8c690bda6f113416558d4bcbbcf3a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_60% Sample e640a65efcae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e640a65efcae…. Malware family: Win/grayware_confidence_60%. Threat score 100/100. 3/27 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L85","11",{}]]