26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T442,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 66bcc997a52f… — Score 80/100 — Hybrid Analysis","description":"Suspicious verdict for sample 66bcc997a52f…. Threat score 80/100. 0/28 AV engines flagged this file. 2 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a"],"about":{"@type":"SoftwareApplication","name":"Avery20Wizard205.0.0.3026.520-20en-AU.exe","applicationCategory":["peexe","executable"],"identifier":"66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a","additionalType":"Suspicious sample"},"threatScore":80,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1655,Found API call GetVersion@KERNEL32.dll (Target: "setup_x86.exe.671954147"; Stream UID: "38050-6856-00455A76") which is directly followed by "cmp eax, 80000000h" and "jbe 00455F4Ah". See related instructions: "... +1145 call esi ;GetVersion +1147 cmp eax, 80000000h +1152 jbe 00455F4Ah" ... at 38050-6856-00455A76 Found API call GetVersionExW@KERNEL32.dll (Target: "setup_x86.exe.671954147"; Stream UID: "38050-8406-0044F9B1") which is directly followed by "cmp dword ptr [ebp-70h], 01h" and "jne 0044FA35h". See related instructions: "... +0 push ebp +1 lea ebp, dword ptr [esp-00000098h] +8 sub esp, 00000118h +14 mov eax, dword ptr [004DB020h] +19 xor eax, ebp +21 mov dword ptr [ebp+00000094h], eax +27 mov eax, dword ptr [ebp+000000A0h] +33 and dword ptr [eax], 00000000h +36 push esi +37 mov esi, dword ptr [ebp+000000A4h] +43 and dword ptr [esi], 00000000h +46 lea eax, dword ptr [ebp-80h] +49 push eax +50 mov dword ptr [ebp-80h], 00000114h +57 call dword ptr [004B00F8h] ;GetVersionExW +63 cmp dword ptr [ebp-70h], 01h +67 jne 0044FA35h" ... at 38050-8406-0044F9B1 Found API call GetVersionExA@KERNEL32.dll (Target: "autorun.exe.1480044407"; Stream UID: "53724-12353-0053E37F") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "... +35 call 00644DC0h +40 add esp, 0Ch +43 lea eax, dword ptr [ebp-00000098h] +49 push eax +50 mov dword ptr [ebp-00000098h], 00000094h +60 call dword ptr [007D9618h] ;GetVersionExA +66 mov ecx, dword ptr [ebp-04h] +69 xor eax, eax +71 cmp dword ptr [ebp-00000088h], 02h +78 sete al +81 xor ecx, ebp" ... at 53724-12353-0053E37F Found API call GetVersion@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-9306-10044AFE") which is directly followed by "cmp eax, 80000000h" and "ja 10044D0Ch". See related instructions: "... +271 call dword ptr [100C9244h] ;GetVersion +277 mov esi, 100CC1BCh +282 cmp eax, 80000000h +287 ja 10044D0Ch" ... at 53851-9306-10044AFE Found API call GetVersionExW@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-10615-10022787") which is directly followed by "cmp dword ptr [ebp+4Ch], 08h" and "jnc 10023223h". See related instructions: "... +2667 lea eax, dword ptr [ebp-000008B0h] +2673 push eax +2674 mov dword ptr [ebp-000008B0h], 00000114h +2684 call dword ptr [100C919Ch] ;GetVersionExW +2690 cmp dword ptr [ebp-000008ACh], 05h +2697 mov eax, dword ptr [ebp+38h] +2700 setb byte ptr [ebp-000008C9h] +2707 cmp dword ptr [ebp+4Ch], 08h +2711 jnc 10023223h" ... at 53851-10615-10022787 Found API call GetVersion@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-9307-1004430C") which is directly followed by "cmp eax, 80000000h" and "jbe 100443F6h". See related instructions: "... +10 call 10099F9Ch +15 call dword ptr [100C9244h] ;GetVersion +21 cmp eax, 80000000h +26 jbe 100443F6h" ... at 53851-9307-1004430C Found API call GetVersionExW@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-10954-10039223") which is directly followed by "cmp dword ptr [ebp+10h], edi" and "jne 100394F3h". See related instructions: "... +665 call 1001D1B9h +670 pop ecx +671 mov bl, al +673 pop ecx +674 lea eax, dword ptr [ebp+00h] +677 push eax +678 mov dword ptr [ebp+00h], 00000114h +685 call dword ptr [100C919Ch] ;GetVersionExW +691 xor edi, edi +693 inc edi +694 cmp dword ptr [ebp+10h], edi +697 jne 100394F3h" ... at 53851-10954-10039223 Found API call GetVersionExW@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-11618-10076056") which is directly followed by "cmp dword ptr [ebp+04h], 05h" and "jne 10076912h". See related instructions: "... +2086 call dword ptr [100C93E0h] ;#9 +2092 lea eax, dword ptr [ebp+00h] +2095 push eax +2096 mov dword ptr [ebp+00h], 00000114h +2103 call dword ptr [100C919Ch] ;GetVersionExW +2109 cmp dword ptr [ebp+04h], 05h +2113 setb al +2116 test al, al +2118 jne 10076912h" ... at 53851-11618-10076056 Found API call GetVersionExW@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-13292-100679ED") which is directly followed by "cmp dword ptr [ebp-50h], 02h" and "jne 10067BAAh". See related instructions: "... +147 call dword ptr [100C919Ch] ;GetVersionExW +153 cmp dword ptr [ebp-50h], 02h +157 jne 10067BAAh" ... at 53851-13292-100679ED Found API call GetVersionExW@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-11645-10078B29") which is directly followed by "cmp dword ptr [ebp+00000808h], 05h" and "jnc 10078D08h". See related instructions: "... +434 lea eax, dword ptr [ebp+00000804h] +440 push eax +441 mov dword ptr [ebp+00000804h], 00000114h +451 call dword ptr [100C919Ch] ;GetVersionExW +457 cmp dword ptr [ebp+00000808h], 05h +464 lea ecx, dword ptr [ebp+00000950h] +470 jnc 10078D08h" ... at 53851-11645-10078B29 Found API call GetVersion@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-13834-10040035") which is directly followed by "cmp eax, 80000000h" and "jbe 10040177h". See related instructions: "... +300 call dword ptr [ecx+08h] +303 mov esi, dword ptr [ebp-5Ch] +306 call dword ptr [100C9244h] ;GetVersion +312 cmp eax, 80000000h +317 jbe 10040177h" ... at 53851-13834-10040035 Found API call GetVersionExW@KERNEL32.dll (Target: "MSI722E.tmp.1300347372"; Stream UID: "53851-13868-10042B3A") which is directly followed by "cmp dword ptr [1012D394h], 06h" and "jc 10042BFBh". See related instructions: "... +60 call 1009A4B0h +65 add esp, 0Ch +68 push esi +69 mov dword ptr [1012D390h], 00000114h +79 call dword ptr [100C919Ch] ;GetVersionExW +85 mov byte ptr [1012D4A4h], 01h +92 pop esi +93 cmp dword ptr [1012D394h], 06h +100 jc 10042BFBh" ... at 53851-13868-10042B3A28:T4fc,Antivirus vendors marked dropped file "lua5.1.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ISRT.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "_isres_0x0409.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ISBEWX64.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "lua51.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ISBEWI64.exe" as clean (type is "PE32+ executable (GUI) Intel Itanium for MS Windows"), Antivirus vendors marked dropped file "Launcher.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSI48E9.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSI7383.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSI722E.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")29:T635,"lua5.1.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ISRT.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "_isres_0x0409.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "setup_x86.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "autorun.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "ISBEWX64.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "setup_x64.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "lua51.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ISBEWI64.exe" has type "PE32+ executable (GUI) Intel Itanium for MS Windows" "Launcher.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "Avery Wizard 5.0.msi" has type "Composite Document File V2 Document Can't read SAT" "Setup.inx" has type "data" "MSI48E9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "IsConfig.ini" has type "ASCII text with CRLF line terminators" "0x0409.ini" has type "Little-endian UTF-16 Unicode text with very long lines with CRLF CR line terminators" "Avery.ico" has type "MS Windows icon resource - 1 icon 32x32" "_ISMSIDEL.INI" has type "Little-endian UTF-16 Unicode text with CRLF CR line terminators" "High1.ogg" has type "Ogg data Vorbis audio mono 44100 Hz ~128000 bps created by: Xiphophorus libVorbis I (1.0 RC2)" "MSI7383.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "MSI722E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2a:T156b,Heuristic match: "9.mp" Heuristic match: "Du6,Al.Gd" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://csc3-2010-aia.verisign.com/CSC3-2010.cer0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "www.avery.com" Pattern match: "www.indigorose.com" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "www.lua.org" Pattern match: "http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d" Pattern match: "www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0U%0" Pattern match: "http://csc3-2010-crl.verisign.com/CSC3-2010.crl0DU" Pattern match: "http://csc3-2010-aia.verisign.com/CSC3-2010.cer0U#0{&K&0`HB0" Pattern match: "http://www.flexerasoftware.com0" Heuristic match: "Y_^[]UjhKdP3EVWPEduuuejhhhDuEe}t3EFF:u3yAu+QR.Md" Pattern match: "crl.microsoft.com/pki/crl/products/CSPCA.crl0H+" Pattern match: "crl.microsoft.com/pki/crl/products/tspca.crl0H+" Pattern match: "zz.zz/zz0zz5zzRichzPEd[J" Heuristic match: "E$E0E8E(X3E PEPuDE,PuL`PhXxuHS;}.u&9}tEPUf9}tu9}tuMh5.jjEPF.Md" Pattern match: "dSetup.iss/zxvURLuninstverbosesmsautosrremoveonlyrebootnoscript_uninstmm2m1llangtransformjff2f1daMain" Pattern match: "OutputDebugStringWIsBadWritePtrExpandEnvironmentStringsWRemoveDirectoryWGetPrivateProfileSectionNamesWWritePrivateProfileSectionWfGetTickCountBFlushInstructionCacheMulDivGetCurrentThreadIdlstrcatWGetDriveTypeWGetLogicalDriveStringsWLoadLibraryAlstrlenAAFlu" Pattern match: "bXp.Ya/ONp" Heuristic match: "E=|\B=W4pbszPg3*\&>XTf+kPZn FE5s@($F.mm" Pattern match: "F.aD/c@FJzvz" Heuristic match: ".>5f?[d:9o.Jng+!MHl~4Fd?yOSVd|,>g<<@0(qc1EM1iSDy2]PAV5els4kB~]:UXR]<)~!(g3eQ=Qd!]G&Bc.GN" Pattern match: "h.fH/&yQql-/lf.4meeCyV!Mk0A4%A4S" Pattern match: "PMh5N.QNH/21inUVt1-B;,|TWQgt" Pattern match: "DI7SV.Fw/OMEh;^" Heuristic match: "w$d1JMM;NV+iWm\)wJlL!`UbD4kA[XKvRLm`Tv^8.Bm" Pattern match: "4O.Xvha/E/5" Heuristic match: "_K|JKYNoZ=9/&OP\P<%#!)=WEI(2w,EUj;;zmJ(bgX{r`y1MU01A\ 59hE]jQ^$3quSRzUb[>91B6/A)Y296p(*W{9:U?.nCTU?.MN" Pattern match: "6kC2PKX.Yv/Z0j" Pattern match: "CfVKKR.jbo9e.PRE/20sc1XaSa_gi.XwCKr[kooJJ+Q;c" Pattern match: "c.td/0;T\e5x.0r:6&" Pattern match: "7.SPT/^z}8gDHZ,$M\j&/" Pattern match: "o0ATB.Vq/Co]94W5BRna?f%IUQ=gDJ,XPUxgb9" Pattern match: "http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1440\margr1440\margt1440\margb1440\gutter0\ltrsect" Pattern match: "S.SYwK/G:qRDS!E" Heuristic match: ".:[cTH3,^$.gU" Pattern match: "i.oQhf/Wbg%Sq1yb/_d-y95f'B_x" Pattern match: "IY.qE/]BFZMt]alSJus&iNL#v]og4" Heuristic match: "@j:yju!T!!!~$A:@`JbJ`a*?SBjPvQ,,9ALea*qO9*t8m]{C5BBqVQcO#PG/:o{-}NC !.Ax" Pattern match: "AiD5.yu/Fb" Pattern match: "s.bP/\xsPjz6\i3R#ujATex{hzYmY7rQWI/.f!@1" Pattern match: "9YSX.rN/X&EjGptFyAP;c{8y8IO3K97B" Heuristic match: "/7+g>T{TFhP8y'1'?oXJ}A`S`.pr" Heuristic match: "vJuq&gzIAr@Cz}fbFW1P**>)Cvbk(%r*V),70(s2f4d;dz|E(%TjqbOX& <@@Lb\Wv.kW" Pattern match: "EM.uS/&U#BN1fvB" Heuristic match: "v%:agnlKc|5ls0l:%uWD 6}kU<`;f#1&Rt+cCuR2-q]6R B2Jgx/.&+dF-@xz0DJ{1$-.Yt" Heuristic match: "i>jm=tn1urV/6wb:yt%zh]\5SHo:#F:DTqVg$c4t87*VR3jcW04.Tf" Pattern match: "eO.tmr/qFm2/{VEx5vJ/6Ult'jhp=Aur|" Heuristic match: "exT/<6.lU" Heuristic match: "]W.kI" Pattern match: "O.bqy/0;jYbPW%Kk4?+iltg" Pattern match: "H.XZft//RF" Pattern match: "0yD1A.wTTf/=u" Pattern match: "n.dMD/5s_S@/:+gklLsB_.0uwRgEX@P1!b`_o-b5R-XG8k" Pattern match: "N.oM/foHZ/W_I2-|X/7]##*OckAwx$*L;f=FyLkRCCn['A24H,?^O`|5Z/\" Pattern match: "q-1.uwu/e%@8{!rCRVFGL?1jpY5" Heuristic match: "pQc)Kq>>7yItnYatUR.eC" Heuristic match: "&FeYrk={T|R`-5l*?feJB*@eTc'DaFk0[Ycz=Y}j9LyOjm.R||ne&#:.:.OzBj$p%F7LKl,;Y'2?u2iRQ.Kz" Pattern match: "FDG3f.BNb/q2" Heuristic match: "-x`ZvW~ .GH" Pattern match: "YDBm.xK/QAR?t=+ryh!mJ8`INKzRk*2*|wZOOR" Heuristic match: "wmwQq~Qs~'gq^+')T.qa" Pattern match: "j.lKC/fg%QDHa%" Pattern match: "r.eWR/OGR" Heuristic match: ";&,De2Pfhj5SQUJ9\)*KlaRl..Tm" Heuristic match: "aqSjRvn2=v)Glw~~Q2F<.CM" Heuristic match: "By=S<7?2o>$&CeatgRSn9lp::.sR9pYO_H;RD@7TjWe&9wV;Wb_N j`/{VeOU@e`KugWxt@qJ'7qQ$&WfUnXK^j/{=#l;df=:gj*bU9G^0F*dJ A[)Ea2f,EJsvmz:ipDn3]S;l4C~k,=YI e*MVzlDV,064)Oc~c.MK"2b:T49f,"EM3M3|]UEP7]U}tE+EEEMMQ7]UEMUMEUU}t:Et2MU3U3HUEEMMUUEE} MMUE3EMUH3HM3HU3HEEEMU3UE%MH3HE%3HM3HUUUEM3MUE%H3HU3HE3HMMMUE3EMUH3HM3HU3HEEEMU3UE%MH3HE%3HM3HUUUEM3MUE%H3HU3HE3HMMMUE3EMUH3HM3HU3HEEEMU3UE%MH3HE%3HM3HUU U }rcEEMU3UE%MH3HE%3HM3HUUUEEMM}t2UE3E3HEMMUUuEEEMUM]UEEMM}t;Ut3E3MU3HUEEMMUU} EM3MUUE%MH3HE%3HM3HUUE3EMMUE%H3HU3HE3HMMU3UEEMUH3HM3HU3HEEM3MUUE%MH3HE%3HM3HUUE3EMMUE%H3HU3HE3HMMU3UEEMUH3HM3HU3HEEM3MUUE%MH3HE%3HM3HUUE3EMMUE%H3HU3HE3HMM M!}rdUE3EMMUE%H3HU3HE3HMMMUU}t3E3MU3HUEEMMuUUE]UQ}u3tCEMtUREPMQUREPMQKUU}LE3MU3HUEEM3UE3HEMMU3E%M3HMUUE3MU3HUEEM3UE3HEMMU3E%M3HMUUE3MU3HUEEM3UE3HEMMUU}t3E3MU3HUEEMMuE]U\EHMUEMQELMUBEMU+QE+EMQEMUB(EMQ,UEH0MUB4EMQ8UEH" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" (Handle: 248) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" (Handle: 248) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" (Handle: 248) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" (Handle: 248) "autorun.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\Wizard\Launcher.exe" (Handle: 948) "autorun.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\Wizard\Launcher.exe" (Handle: 948) "autorun.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\Wizard\Launcher.exe" (Handle: 948) "autorun.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\Wizard\Launcher.exe" (Handle: 948) "Launcher.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\Wizard\setup_x86.exe" (Handle: 588) "Launcher.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\Wizard\setup_x86.exe" (Handle: 588) "Launcher.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\Wizard\setup_x86.exe" (Handle: 588) "Launcher.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\ir_ext_temp_0\Wizard\setup_x86.exe" (Handle: 588) "setup_x86.exe" wrote 1500 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 404) "setup_x86.exe" wrote 4 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 404) "setup_x86.exe" wrote 32 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 404) "setup_x86.exe" wrote 52 bytes to a remote process "C:\Windows\System32\msiexec.exe" (Handle: 404)2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAABERAAAAAAAAAAAAAAAAAAAREREREAAAAAAAAAAAAAAAERERERERERAAAAAAAAAAABEREREREREREREQAAAAAAERERERERERERERERERAAABERFmVVEREREREREREQAAAREmZmZmZVVREREREREAAAERZVERVWZmZmVVURERAAABEmUmZVVREVZmZmVREAAAARFlFmZmZmVVZlVmVRAAABERZlURFVZmZmVRUlUQAAARESZmZlVVESZVJlJlEAAAEREWUmZmZmZlUmVWVRAAABERFlElVlVmZSZVZlEQAAARERJlJlJVplFlUmURAAAAERERZRZSZmUWZSZVEQAAABERESUSVWZVZlJlUREAAAEREREmUmUmUmUWVRERAAABERERFlFlFmZVZlEREQAAARERERJVJVZlUmURERAAAAERERESZSZSZSZREREQAAABEREREWUSUWZlUREREAAAARERERElUlVmVRERERAAABERERERJlERZVEREREQAAARERERERZlVmUREREREAAAERERERERZmVREREREQAAAAAAEREREREREREREREAAAAAAAAAABERERERERERAAAAAAAAAAAAAAAREREREQAAAAAAAAAAAAAAAAABEREAAAAAAAAAAAAAAAAAAAAAAAAD/////+H////gD///4AA//+AAAP/AAAAHwAAAB8AAAAfAAAAHwAAAD8AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAH4AAAB+AAAAfAAAAHwAAAB8AAAA/AAAAPwAAAD8AAAA+AAAAPgAAAD4AAAB/4AAAf/+AAH///gB////wf/////w==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAABERAAAAAAAAAAAAAAAAAAAREREREAAAAAAAAAAAAAAAERERERERERAAAAAAAAAAABEREREREREREREQAAAAAAERERERERERERERERERAAABERFmVVEREREREREREQAAAREmZmZmZVVREREREREAAAERZVERVWZmZmVVURERAAABEmUmZVVREVZmZmVREAAAARFlFmZmZmVVZlVmVRAAABERZlURFVZmZmVRUlUQAAARESZmZlVVESZVJlJlEAAAEREWUmZmZmZlUmVWVRAAABERFlElVlVmZSZVZlEQAAARERJlJlJVplFlUmURAAAAERERZRZSZmUWZSZVEQAAABERESUSVWZVZlJlUREAAAEREREmUmUmUmUWVRERAAABERERFlFlFmZVZlEREQAAARERERJVJVZlUmURERAAAAERERESZSZSZSZREREQAAABEREREWUSUWZlUREREAAAARERERElUlVmVRERERAAABERERERJlERZVEREREQAAARERERERZlVmUREREREAAAERERERERZmVREREREQAAAAAAEREREREREREREREAAAAAAAAAABERERERERERAAAAAAAAAAAAAAAREREREQAAAAAAAAAAAAAAAAABEREAAAAAAAAAAAAAAAAAAAAAAAAD/////+H////gD///4AA//+AAAP/AAAAHwAAAB8AAAAfAAAAHwAAAD8AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAH4AAAB+AAAAfAAAAHwAAAB8AAAA/AAAAPwAAAD8AAAA+AAAAPgAAAD4AAAB/4AAAf/+AAH///gB////wf/////w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB4iIcAAAAAAAAAdwAAAAAAf//3cAAAAAAAd4iKoAAAAH//94cAAAAAB4iIiquwAAB///eIcAAAAH+IiIq77gAAf//3iIcAAAd4+IiKvugAAH//94iHAAAHiI+I+r6IgAB///eIhwAAB4iI9wfoiIAATMzEiIcAAAeIiKDwiIiAAEzMxEiHAAAHiIrnB4iIgABMzMREhwd3d4iq64j4iIAATMzAREcIiIh6rruIj4gAAH//8ARECIiIeu67iIj4AAd///CARAiIiIfru4iIgAB3h3d4jwQP////d7uIh3AAeHiIeP/wB3d3d3d3d3hwAH+HiIB3dwAAAAAAAAB3gAAH+HgH//8IiIiIiIiHB3AAAH+AB///D///////h3AAAAAH8AB3d0RERERET4dwAAAAAHAAB/TohmZszE+HcAAAAAAAAAf0/ohmZsxPh3AAAAAAAAAH9O/ohmZsT4dwAAAAAAAAB/T+/ohmZk+HcAAAAAAAAAf07+/ohmZPh3AAAAAAAAAH9I7+/ohmT4dwAAAAAAAAB/SI7+/ohk+HcAAAAAAAAAf0iI7+/ohPh3AAAAAAAAAH9ERERERET4dwAAAAAAAAB//////////3cAAAAAAAAAB4iIiIiIiIiHAAAAAAAAAAB3d3d3d3d3dwAADA////wH/8H8A/8AfAH+ADwA/AAcAHgAHAB4AAwAeAAMAHgADAAAAAwAAAAMAAAAHAAAABgAAAAwAAAAMAAAADAAAAA4AAAAfCAAAP4wAAD/OAAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//gAAP/4AAD/+AAA//wAAP/+AAHw==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREVVVVVVVVVVVVVUREREREmZmZmZmZmZmZmZmVRERESZVVVVVVVVVVVZlVWZRERFlUREREREREREmUREWVRERZRJmZmZmZmZmZVFlElUREWURVlZWVlVVZmUSZRZVERElURERERERERZVFlUWURERFmVVVVVVVVVlUWVRZVERERJmZmZmZmZmZRJlEmURERERZVVlVWVRFlUWVRZVERERESZRJlEmUSZRJlEmUREREREWVRZVFlVlUWVRZVEREREREmUSZRJmZRJlEmURERERERFlUWVRZlUWVRZVERERERERJlEmUSZRZVFlURERERERERZVFlUWVmUSZRERERERERERZVFlUWZVFlURERERERERESZRJlEmUSZREREREREREREWVRZVFlVlUREREREREREREmUSZRJmZRERERERERERERFlUWVRZlURERERERERERERJlElUWVRERERERERERERERZVERJlERERERERERERERERZVVmVRERERERERERERERERZmZVERERERERERERERERERFVEREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREREQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":80,"unified_at_epoch_ms":1791219233503,"unified_at":"2026-10-05T16:53:53.503Z","metadata":{"hashes":{"sha256":"66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a","sha1":"c7a661026b6f01b730e4f11b7dc9984395216c27","md5":"dec37273ba78df156615588e6ac18279","sha512":"99ff8cda35869b68b9cc61dcfc7e83c31b47d7af2ec1a63afa23d7698fe2ac9be25353cab96a54fbdf4491fa7d502e4b22769ebce9db0595ece024ea5075e4aa","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Avery20Wizard205.0.0.3026.520-20en-AU.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":27782520,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1507863222000,"last_seen":1659722576000,"last_multi_scan":1659722576000}},"detections":{"summary":{"verdict":"suspicious","score":80,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":20,"suspicious_count":18,"malicious_count":2,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 33798-1815-10035121\n SetUnhandledExceptionFilter@KERNEL32.dll at 38050-4747-0046FA78\n SetUnhandledExceptionFilter@KERNEL32.dll at 38050-9440-0047CFFD\n SetUnhandledExceptionFilter@KERNEL32.dll at 48767-348-000000014000AA50\n SetUnhandledExceptionFilter@KERNEL32.dll at 48767-307-000000014000B720\n SetUnhandledExceptionFilter@KERNEL32.dll at 48767-335-000000014000DC28\n SetUnhandledExceptionFilter@KERNEL32.dll at 53724-10538-006536E3\n SetUnhandledExceptionFilter@KERNEL32.dll at 53851-10192-100A7338","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 33798-1444-1001E6FB\n GetSystemTimeAsFileTime@KERNEL32.dll at 33798-1695-1001E742\n GetSystemTimeAsFileTime@KERNEL32.dll at 33798-1694-1001E569\n GetLocalTime@KERNEL32.dll at 38050-5270-00451A7F\n GetLocalTime@KERNEL32.dll at 38050-9560-00456020","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 33798-1679-1002E8B4\n GetTimeZoneInformation@KERNEL32.dll at 38050-6036-0048CBD2\n GetTimeZoneInformation@KERNEL32.dll at 45880-2067-100133D0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 38050-5042-004141FF\n GetVersionExW@KERNEL32.dll at 38050-4916-0044673D\n GetVersionExW@KERNEL32.dll at 38050-5170-00446531\n GetVersionExW@KERNEL32.dll at 38050-5169-004464EF\n GetVersionExW@KERNEL32.dll at 38050-5168-004464AF\n GetVersion@KERNEL32.dll at 38050-6856-00455A76\n GetVersionExW@KERNEL32.dll at 38050-8406-0044F9B1\n GetVersionExA@KERNEL32.dll at 45880-2096-10010E50\n GetVersionExA@KERNEL32.dll at 53724-9922-0068F3D0\n GetVersionExA@KERNEL32.dll at 53724-12353-0053E37F\n GetVersion@KERNEL32.dll at 53851-9306-10044AFE\n GetVersionExW@KERNEL32.dll at 53851-9013-1002DCFE\n GetVersionExW@KERNEL32.dll at 53851-10615-10022787\n GetVersion@KERNEL32.dll at 53851-9307-1004430C\n GetVersionExW@KERNEL32.dll at 53851-10954-10039223\n GetVersionExW@KERNEL32.dll at 53851-11618-10076056\n GetVersionExW@KERNEL32.dll at 53851-13292-100679ED\n GetVersionExW@KERNEL32.dll at 53851-11645-10078B29\n GetVersion@KERNEL32.dll at 53851-13834-10040035\n GetVersionExW@KERNEL32.dll at 53851-13868-10042B3A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.dll at 33798-1714-10030ED3\n EnumSystemLocalesA@KERNEL32.dll at 33798-1715-10030E97\n EnumSystemLocalesA@KERNEL32.dll at 33798-1717-10030E30\n GetUserDefaultLCID@KERNEL32.dll at 38050-5791-00480081\n EnumSystemLocalesA@KERNEL32.dll at 38050-5792-00480045\n EnumSystemLocalesA@KERNEL32.dll at 38050-5794-0047FFDE\n GetUserDefaultLCID@KERNEL32.dll at 38050-9367-0047FAE8\n EnumSystemLocalesA@KERNEL32.dll at 38050-9459-0047FFB2\n EnumSystemLocalesA@KERNEL32.dll at 45880-2102-10010A00\n EnumSystemLocalesA@KERNEL32.dll at 45880-2104-10010610\n GetUserDefaultLCID@KERNEL32.dll at 45880-2106-10010CA0\n EnumSystemLocalesA@KERNEL32.dll at 45880-2107-10010BA0\n GetUserDefaultLCID@KERNEL32.dll at 53851-10533-10017AD6\n GetUserDefaultLCID@KERNEL32.dll at 53851-8677-10017B44","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.dll at 53851-8861-100256F1","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$27","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 53724-10765-007AB0A0\n GetProcessHeap@KERNEL32.dll at 53851-9694-1008A8D1\n GetProcessHeap@KERNEL32.dll at 53851-10053-1008A740\n GetProcessHeap@KERNEL32.dll at 53851-10046-1008A510\n GetProcessHeap@KERNEL32.dll at 53851-8160-1008A5D0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"autorun.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\LAUNCHER.EXE\")\n \"autorun.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\LAUNCHER.EXE\")\n \"Launcher.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SETUP_X86.EXE\")\n \"Launcher.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SETUP_X86.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/62 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\CodeBases\\isdev\\src\\Runtime\\MSI\\Shared\\Setup\\Setup___Win32_Release_Unicode\\setup.pdb\"\n \"C:\\CodeBases\\isdev\\Redist\\Language Independent\\x64\\ISBEW64.pdb\"\n \"=L9o<{OyzOLEACC.dllH8y@\" created file \"%TEMP%\\ir_ext_temp_0\\AutoPlay\\Audio\\Click1.ogg\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\AutoPlay\\Audio\\High1.ogg\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\AutoPlay\\autorun.cdd\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\AutoPlay\\Icons\\Avery.ico\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\autorun.exe\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\Avery.ico\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\lua5.1.dll\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\lua51.dll\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\Wizard\\Launcher.exe\"\n \"\" created file \"%TEMP%\\ir_ext_temp_0\\Wizard\\setup_x64.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"DirectSound Administrator shared thread array (lock)\"\n \"Local\\DirectSound DllMain mutex (0x00000BA8)\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\MidiMapper_modLongMessage_RefCnt\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt\"\n \"\\Sessions\\1\\BaseNamedObjects\\DirectSound Administrator shared thread array (lock)\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\DirectSound DllMain mutex (0x00000BA8)\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$28","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Launcher.exe\" (UID: 00015070-00003784) was launched with new environment variables: \"LUA_PATH=\"!\\AutoPlay\\Scripts\\?;!\\AutoPlay\\Scripts\\?.lua;.\\?.lua;!\\lua\\?.lua;!\\lua\\?\\init.lua;!\\?.lua;!\\?\\init.lua\\AutoPlay\\Scripts\\?.lua;;!\\?.lua;!\\?;?;?.lua;\", __COMPAT_LAYER=\"ElevateCreateProcess\", LUA_CPATH=\"!\\AutoPlay\\Scripts\\?;!\\AutoPlay\\Scripts\\?.dll;.\\?.dll;.\\?51.dll;!\\?.dll;!\\?51.dll;!\\clibs\\?.dll;!\\clibs\\?51.dll;!\\loadall.dll;!\\clibs\\loadall.dll\\AutoPlay\\Scripts\\?.dll;;!\\?.dll;!\\?;\"\"\n Process \"Launcher.exe\" (UID: 00015070-00003784) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"autorun.exe\" with commandline \"\"SFXSOURCE:C:\\66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a.exe\"\" (UID: 00014862-00002984)\n Spawned process \"Launcher.exe\" (UID: 00015070-00003784)\n Spawned process \"setup_x86.exe\" (UID: 00015240-00003772)\n Spawned process \"msiexec.exe\" with commandline \"/i \"%TEMP%\\{33084D30-2061-402F-B5A1-7CA82473D276}\\Avery Wizard 5.0.msi\" SETUPEXEDIR=\"%TEMP%\\ir_ext_temp_0\\Wizard\" SETUPEXENAME=\"setup_x86.exe\"\" (UID: 00015952-00003800)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"\n \"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\system32\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\tzres.dll.mui\"\n \"autorun.exe\" touched file \"%WINDIR%\\AppPatch\\AcLayers.DLL\"\n \"autorun.exe\" touched file \"%WINDIR%\\system32\\tzres.dll\"\n \"autorun.exe\" touched file \"%WINDIR%\\system32\\en-US\\tzres.dll.mui\"\n \"autorun.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"autorun.exe\" touched file \"%WINDIR%\\system32\\wdmaud.drv\"\n \"autorun.exe\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"autorun.exe\" touched file \"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui\"\n \"autorun.exe\" touched file \"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"lua5.1.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"ISRT.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"_isres_0x0409.dll\" was detected as \"Microsoft visual C++ v6.0 (Debug version)\"\n \"setup_x86.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"autorun.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"setup_x64.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"lua51.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"\n \"Launcher.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"MSI48E9.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"MSI7383.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 10 calls to GetProcAddress@KERNEL32.dll at 48767-573-0000000140007190","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"lua5.1.dll.127474927\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$2b","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"setup_x86.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 38050-5050-00417786\n FindResourceW@KERNEL32.dll at 38050-8444-004355C2\n FindResourceW@KERNEL32.dll at 48767-424-0000000140005790\n FindResourceA@KERNEL32.dll at 53724-10934-006691F0\n FindResourceA@KERNEL32.dll at 53724-10928-006692A0\n FindResourceA@KERNEL32.dll at 53724-11761-00670F10\n FindResourceA@KERNEL32.dll at 53724-11760-00675AC0\n FindResourceA@KERNEL32.dll at 53724-11763-00670810\n LockResource@KERNEL32.dll at 53724-11764-006AC040\n FindResourceA@KERNEL32.dll at 53724-11914-00670760\n FindResourceA@KERNEL32.dll at 53724-12055-00675C10\n FindResourceW@KERNEL32.dll at 53851-9794-100674D8\n FindResourceW@KERNEL32.dll at 53851-9920-100AD300\n FindResourceW@KERNEL32.dll at 53851-9932-10066CCB\n FindResourceW@KERNEL32.dll at 53851-13739-10004A21","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"autorun.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"Launcher.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"autorun.exe\" called \"OpenService\" to access the \"AudioSrv\" service\n \"autorun.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"autorun.exe\" called \"OpenService\" to access the \"AudioSrv\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"autorun.exe\" called \"OpenService\" to access the \"PcaSvc\" service\n \"Launcher.exe\" called \"OpenService\" to access the \"PcaSvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$2c","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.05.0.0\"\n \"2.9.0.0\"\n \"2.5.4.3\"\n \"2.5.4.11\"\n \"2.5.4.10\"\n Heuristic match: \"2.5.29.21 %02X%s\"\n Heuristic match: \"0x%08X [%d,%d] %s (%S) [%d] %s (%S)%d{%08lX-%04hX-%04hX-%02X%02X-%02X%02X%02X%02X%02X%02X} [%d] 1.2.840.113549.1.9.51.2.840.113549.1.9.61.3.6.1.4.1.311.10.2 [%d,%d] %s\"\n Heuristic match: \"1.2.840.113549.1.9.152.5.4.32.5.29.322.5.29.152.5.29.102.5.29.42.5.29.182.5.29.172.5.29.82.5.29.72.5.29.22.5.29.142.5.29.312.5.29.352.5.29.1%s\"\n Heuristic match: \"1.3.6.1.4.1.311.10.21.2.840.113549.1.9.61.2.840.113549.1.9.5 [%d] %s\"\n Heuristic match: \"2.5.29.12.5.29.352.5.29.312.5.29.142.5.29.22.5.29.72.5.29.82.5.29.172.5.29.182.5.29.42.5.29.102.5.29.152.5.29.322.5.4.31.2.840.113549.1.9.152.5.29.21 [%d] %s (%S)%s\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"Zvncx`(D@)\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 38050-6829-00492982","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.dll at 53724-12485-00726CBD","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"autorun.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"autorun.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Launcher.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Launcher.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"autorun.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"Launcher.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ISRT.dll\" claimed CRC 691132 while the actual is CRC 338845\n \"setup_x86.exe\" claimed CRC 11604057 while the actual is CRC 564932\n \"autorun.exe\" claimed CRC 6476118 while the actual is CRC 5216041\n \"ISBEWX64.exe\" claimed CRC 168474 while the actual is CRC 5197768\n \"setup_x64.exe\" claimed CRC 12668460 while the actual is CRC 168474\n \"ISBEWI64.exe\" claimed CRC 370564 while the actual is CRC 74403\n \"Launcher.exe\" claimed CRC 1657248 while the actual is CRC 370564\n \"MSI48E9.tmp\" claimed CRC 143721 while the actual is CRC 1657248\n \"MSI7383.tmp\" claimed CRC 1450972 while the actual is CRC 143721","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"ISBEWI64.exe\" has an entrypoint in section \".rdata\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2d","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"autorun.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"setup_x86.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"msiexec.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2e","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014570-00003640)\n Spawned process \"autorun.exe\" with commandline \"\"SFXSOURCE:C:\\66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a.exe\"\" (UID: 00014862-00002984)\n Spawned process \"Launcher.exe\" (UID: 00015070-00003784)\n Spawned process \"setup_x86.exe\" (UID: 00015240-00003772)\n Spawned process \"msiexec.exe\" with commandline \"/i \"%TEMP%\\{33084D30-2061-402F-B5A1-7CA82473D276}\\Avery Wizard 5.0.msi\" SETUPEXEDIR=\"%TEMP%\\ir_ext_temp_0\\Wizard\" SETUPEXENAME=\"setup_x86.exe\"\" (UID: 00015952-00003800)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":83,"dropped_files_count":0,"extracted_files_count":25,"files_written_count":144,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"59e028277ca3e11c867f7c19","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":80,"submit_name":"Avery20Wizard205.0.0.3026.520-20en-AU.exe","analysis_start_time":"2017-10-13T03:40:30+00:00","indicators_count":{"informative":20,"suspicious":24,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}],"processes":[{"pid":3640,"ppid":0,"name":"66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a.exe","command_line":"","sha256":"66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a","normalized_path":"C:\\66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a.exe","uid":"00014570-00003640","icon":"$2f"},{"pid":2984,"ppid":3640,"name":"autorun.exe","command_line":"\"SFXSOURCE:C:\\66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a.exe\"","sha256":"5e8a8b68f96b3e6838aa0150ddcff22da3de90ac119d109bff10fa272c46bda2","normalized_path":"%TEMP%\\ir_ext_temp_0\\autorun.exe","parent_uid":"00014570-00003640","uid":"00014862-00002984","icon":"$30"},{"pid":3784,"ppid":2984,"name":"Launcher.exe","command_line":"","sha256":"3dd00a2e0d4290975be9b5a1042ce9e2098361f66ab6e8a48e3bd11884f69196","normalized_path":"%TEMP%\\ir_ext_temp_0\\Wizard\\Launcher.exe","parent_uid":"00014862-00002984","uid":"00015070-00003784","icon":"$31"},{"pid":3772,"ppid":3784,"name":"setup_x86.exe","command_line":"","sha256":"f7ec18fcf566c0f8f2901bfbef8ad1d1c555860420fe1a16f7145fa73aca36a8","normalized_path":"%TEMP%\\ir_ext_temp_0\\Wizard\\setup_x86.exe","parent_uid":"00015070-00003784","uid":"00015240-00003772","icon":"$32"},{"pid":3800,"ppid":3772,"name":"msiexec.exe","command_line":"/i \"%TEMP%\\{33084D30-2061-402F-B5A1-7CA82473D276}\\Avery Wizard 5.0.msi\" SETUPEXEDIR=\"%TEMP%\\ir_ext_temp_0\\Wizard\" SETUPEXENAME=\"setup_x86.exe\"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00015240-00003772","uid":"00015952-00003800","icon":"$33"}],"all_imported_dlls":["winmm.dll","shell32.dll","KernelBase.dll","msvcrt.dll","wkscli.dll","userenv.dll","fusion.dll","ole32.dll","oledlg.dll","dsound.dll","msi.dll","cryptsp.dll","ntdll.dll","clbcatq.dll","version.dll","powrprof.dll","shdocvw.dll","crypt32.dll","setupapi.dll","RpcRtRemote.dll","apphelp.dll","urlmon.dll","ksuser.dll","oleacc.dll","netapi32.dll","srvcli.dll","MMDevAPI.dll","ntmarta.dll","Wldap32.dll","sechost.dll","gdi32.dll","msimg32.dll","msasn1.dll","imagehlp.dll","AudioSes.dll","lua5.1.dll","user32.dll","uxtheme.dll","rpcss.dll","wininet.dll","mpr.dll","avrt.dll","midimap.dll","usp10.dll","ws2_32.dll","msacm32.dll","AcLayers.dll","mscoreei.dll","msihnd.dll","sfc.dll","msimsg.dll","mscoree.dll","sxs.dll","lpk.dll","oleaut32.dll","tzres.dll","sspicli.dll","propsys.dll","cfgmgr32.dll","sfc_os.dll","samcli.dll","shlwapi.dll","dwmapi.dll","nsi.dll","devobj.dll","devrtl.dll","rpcrt4.dll","msftedit.dll","oleaccrc.dll","rsaenh.dll","advapi32.dll","kernel32.dll","comctl32.dll","imm32.dll","msctf.dll","iertutil.dll","GdiPlus.dll","AcGenral.dll","comdlg32.dll","cryptbase.dll","wsock32.dll","netutils.dll","profapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"MSI48E9.tmp","sha256":"ba69e6dc123cf9a4520ec71ddf94c2c51dc8ca951ba468c1d674ac80c798fce5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"MSI722E.tmp","sha256":"e90d9795acde73cd7f8ed9fc0546496a13837d1c9966b84f9250e67ffeee0936","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"MSI7383.tmp","sha256":"e90d9795acde73cd7f8ed9fc0546496a13837d1c9966b84f9250e67ffeee0936","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Launcher.exe","sha256":"3dd00a2e0d4290975be9b5a1042ce9e2098361f66ab6e8a48e3bd11884f69196","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"lua5.1.dll","sha256":"e83439d2b1aed783aedeaeec84d81afd695513bd9d8d554ff662defab064aef6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"lua51.dll","sha256":"1c2d1ba8425139d45de89192d2ae4982e9581f8ae0f22b8497aa0055080237ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"ISBEWI64.exe","sha256":"15b919cf9f62d459ec5f7a8902a5a3b213954e19224a0c1882077a4bd8cfe4e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"ISBEWX64.exe","sha256":"081491c300116646e02fca9982e69f663893e8b7b29708d2bac2ce8dadeb245a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"ISRT.dll","sha256":"2b37ffbb934b6b06aabd76b43b45e15f1a243ed3cfaa1da3aa9ac60c35dd4ae2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"_isres_0x0409.dll","sha256":"f49d1b4055660bf83ee9d8bbc2811bd2bdd0a034cc88db748cbe72ce72203ab4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"setup_x86.exe","sha256":"5e9c6227112d97951cc51fb19b1f6c3370b4c6e99b7b8df6d9a850faa5c0c0f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Avery Wizard 5.0.msi","sha256":"07e51407a9c6457a3722e01d39e04984ba8d6773c07c9e986b392702cd7b0dde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Setup.INI","sha256":"d887f4eab0d2cd5e9f2b057da4eca575fcbeece19f303fd9286880c94a7319c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"MSI71DC.tmp","sha256":"ba69e6dc123cf9a4520ec71ddf94c2c51dc8ca951ba468c1d674ac80c798fce5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"MSI7219.tmp","sha256":"68653956ea7674ec9e8e643b573c9c8fbee00b7d07d4fc89fb0e233844c68683","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"MSIA5E6.tmp","sha256":"ba69e6dc123cf9a4520ec71ddf94c2c51dc8ca951ba468c1d674ac80c798fce5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Click1.ogg","sha256":"25d49cbbd65d48ad462455f1143f73ee997df8f747e7d2213daab18e321c028b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"High1.ogg","sha256":"ee9a4903a8df90eff4c5b65a8073e564a3581cf73772a72eb82396e69932e769","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"autorun.cdd","sha256":"6d59e97366af33bd98b3b76bce1b9def0aab3cc24526f50f4142435fcd408667","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Avery.ico","sha256":"a7a08db1aba4157ae9b0dd73f12a92a242ab33370ead43b1878e8538f8db35a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"setup_x64.exe","sha256":"e6aa3e4c31a012f3610b65db5b18b25ac3ab7d62a9c60099a55070b9913a41ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"autorun.exe","sha256":"3e2c257ed88dbf8cc2c04ae4475de325623b0537ac1f86a7e5d43f294617d40e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"iss60E4.tmp","sha256":"e90d9795acde73cd7f8ed9fc0546496a13837d1c9966b84f9250e67ffeee0936","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"0x0409.ini","sha256":"e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Setup.inx","sha256":"4ead95d3bc63583a41db472a295715ba9573d4a90af2cbcc9e07b685a6a3a4dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]}],"files_written":[{"path":"C:\\66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a.exe","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\ir_ext_temp_0\\AutoPlay\\Icons","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\ir_ext_temp_0\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\d3d9.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\dsound.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\ir_ext_temp_0\\autorun.exe","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\WINMM.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\ir_ext_temp_0\\Avery.ico","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\ir_ext_temp_0\\AutoPlay\\autorun.cdd","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\ir_ext_temp_0\\0x0000.ini","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{33084D30-2061-402F-B5A1-7CA82473D276}\\0x0000.ini","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{33084D30-2061-402F-B5A1-7CA82473D276}\\Setup.INI","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{33084D30-2061-402F-B5A1-7CA82473D276}\\0x0409.ini","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\ir_ext_temp_0\\Wizard\\setup_x86.exe","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{58686A37-6D79-43CA-8FCE-336170617A55}","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{58686A37-6D79-43CA-8FCE-336170617A55}\\_isres_0x0409.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{58686A37-6D79-43CA-8FCE-336170617A55}\\ISBEWI64.exe","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{58686A37-6D79-43CA-8FCE-336170617A55}\\ISBEWX64.exe","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{58686A37-6D79-43CA-8FCE-336170617A55}\\IsConfig.ini","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{58686A37-6D79-43CA-8FCE-336170617A55}\\ISRT.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{58686A37-6D79-43CA-8FCE-336170617A55}\\Setup.inx","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{33084D30-2061-402F-B5A1-7CA82473D276}\\_ISMSIDEL.INI","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{58686A37-6D79-43CA-8FCE-336170617A55}\\String1033.txt","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\MSIEXEC.EXE.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\{33084D30-2061-402F-B5A1-7CA82473D276}\\Avery Wizard 5.0.msi","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\MsiMsg.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\MsiMsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en\\MsiMsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\MSIEXEC.EXE.config","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sxs.DLL","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ar-SA\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\bg-BG\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\cs-CZ\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\da-DK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\de-DE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\el-GR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\es-ES\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\et-EE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\fi-FI\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\fr-FR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\he-IL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\hr-HR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\hu-HU\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\it-IT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ja-JP\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ko-KR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\lt-LT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\lv-LV\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\nb-NO\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\nl-NL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\pl-PL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\pt-BR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\pt-PT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ro-RO\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ru-RU\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sk-SK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sl-SI\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sr-Latn-CS\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sv-SE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\th-TH\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\tr-TR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\uk-UA\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\zh-CN\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\zh-HK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\zh-TW\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en-US\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ar-SA\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\bg-BG\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\cs-CZ\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\da-DK\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\de-DE\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\el-GR\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\en\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\es-ES\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\et-EE\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\fi-FI\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\fr-FR\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\he-IL\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\hr-HR\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\hu-HU\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\it-IT\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ja-JP\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ko-KR\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\lt-LT\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\lv-LV\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\nb-NO\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\nl-NL\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\pl-PL\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\pt-BR\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\pt-PT\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ro-RO\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\ru-RU\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sk-SK\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sl-SI\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sr-Latn-CS\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\sv-SE\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\th-TH\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\tr-TR\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\uk-UA\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\zh-CN\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\zh-HK\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%WINDIR%\\system32\\zh-TW\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\MSI2747b.LOG","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"path":"%TEMP%\\MSIA5E6.tmp","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"DirectSound Administrator shared thread array (lock)","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Local\\DirectSound DllMain mutex (0x00000BA8)","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DirectSound Administrator shared thread array (lock)","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\DirectSound DllMain mutex (0x00000BA8)","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_d5ce92001d3440fGOL.b7472ISM_pmeT_lacoL_ataDppA_1FYuliQ_sresU_:C","sources":[{"report_type":"sandbox","report_id":"59e028277ca3e11c867f7c19"}]}]}},"report_ids":{"sandbox_job_ids":["59e028277ca3e11c867f7c19"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Sample 66bcc997a52f… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 66bcc997a52f…. Threat score 80/100. 0/28 AV engines flagged this file. 2 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 66bcc997a52f… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 66bcc997a52f…. Threat score 80/100. 0/28 AV engines flagged this file. 2 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/66bcc997a52f917cadf37d70b484d93eb11d24cce43a020f55f6ea9ebca7239a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 66bcc997a52f… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 66bcc997a52f…. Threat score 80/100. 0/28 AV engines flagged this file. 2 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]