24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T41e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 962c9254c513… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 962c9254c513…. Threat score 85/100. 0/27 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa"],"about":{"@type":"SoftwareApplication","name":"setup.exe","applicationCategory":["peexe","executable"],"identifier":"962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T23bf,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayPtrOfIndex"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperBuffW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "VariantInit"; Source: "sample.bin"), Found reference to API (Indicator: "SignalObjectAndWait"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetSearchPathMode"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardType"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayGetLBound"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "EnumCalendarInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "VariantClear"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SysReAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VariantCopy"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayCreate"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayGetUBound"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "VariantChangeType"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin")26:T528,file/memory contains long string(File: "cls-srep_x64.exe") file/memory contains long string(File: "rz-1.03.7-stdio.exe") file/memory contains long string(File: "rz.exe") file/memory contains long string(File: "cls-srep_x86.exe") Found string "For compression, a window-size of (1/64/512)M uses ~(55/900/6500)M of memory." (Source: "00000000-00002812.00000001.298168.00AEE000.00000004.mdmp, 00000000-00002812.00000002.300089.00AEE000.00000004.mdmp, 00000000-00002812.00000003.307440.00AEE000.00000004.mdmp") Found string "Defines values for the compression modes used to save the Ink object to a serialized format.WW" (Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp") Found string "Setting NTFS compression on directory: %s" (Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found string "Unsetting NTFS compression on directory: %s" (Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found string "Failed to set NTFS compression state (%d)." (Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found string "Setting NTFS compression on file: %s" (Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found string "Unsetting NTFS compression on file: %s" (Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp")27:T77bc,Found XOR loop in file "razor.dll" at offset 28855; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 83138; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 84274; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 100997; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 124231; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 134206; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 178396; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 178661; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 200975; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 203456; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 234169; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 257054; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 338358; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 360779; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 361033; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 375085; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 381764; code bytes = 30d0 Found XOR loop in file "razor.dll" at offset 26555; code bytes = 33c1 Found XOR loop in file "razor.dll" at offset 160018; code bytes = 33c1 Found XOR loop in file "razor.dll" at offset 184213; code bytes = 33c1 Found XOR loop in file "razor.dll" at offset 275793; code bytes = 33c1 Found XOR loop in file "razor.dll" at offset 383196; code bytes = 33c1 Found XOR loop in file "razor.dll" at offset 55103; code bytes = 8030 Found XOR loop in file "razor.dll" at offset 67943; code bytes = 8030 Found XOR loop in file "razor.dll" at offset 105694; code bytes = 8030 Found XOR loop in file "razor.dll" at offset 118993; code bytes = 8030 Found XOR loop in file "razor.dll" at offset 141318; code bytes = 8030 Found XOR loop in file "razor.dll" at offset 147078; code bytes = 8030 Found XOR loop in file "razor.dll" at offset 159192; code bytes = 8030 Found XOR loop in file "razor.dll" at offset 229890; code bytes = 8030 Found XOR loop in file "razor.dll" at offset 376768; code bytes = 8030 Found XOR loop in file "ISDone.dll" at offset 19553; code bytes = 30d0 Found XOR loop in file "ISDone.dll" at offset 161921; code bytes = 30d0 Found XOR loop in file "ISDone.dll" at offset 297953; code bytes = 30d0 Found XOR loop in file "ISDone.dll" at offset 366793; code bytes = 30d0 Found XOR loop in file "ISDone.dll" at offset 381189; code bytes = 30d0 Found XOR loop in file "ISDone.dll" at offset 172166; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 172172; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 214108; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 223617; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 223971; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 224006; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 224041; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 224076; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 240579; code bytes = 33c1 Found XOR loop in file "ISDone.dll" at offset 220132; code bytes = 8030 Found XOR loop in file "ISDone.dll" at offset 220464; code bytes = 8030 Found XOR loop in file "ISDone.dll" at offset 267096; code bytes = 8030 Found XOR loop in file "ISDone.dll" at offset 297914; code bytes = 8030 Found XOR loop in file "ISDone.dll" at offset 378912; code bytes = 8030 Found XOR loop in file "ISDone.dll" at offset 381150; code bytes = 8030 Found XOR loop in file "ISDone.dll" at offset 382792; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 50064; code bytes = 30d0 Found XOR loop in file "cls-magic2l_x64.exe" at offset 314020; code bytes = 30d0 Found XOR loop in file "cls-magic2l_x64.exe" at offset 129860; code bytes = 33c1 Found XOR loop in file "cls-magic2l_x64.exe" at offset 138006; code bytes = 33c1 Found XOR loop in file "cls-magic2l_x64.exe" at offset 138687; code bytes = 33c1 Found XOR loop in file "cls-magic2l_x64.exe" at offset 149303; code bytes = 33c1 Found XOR loop in file "cls-magic2l_x64.exe" at offset 150788; code bytes = 33c1 Found XOR loop in file "cls-magic2l_x64.exe" at offset 274508; code bytes = 33c1 Found XOR loop in file "cls-magic2l_x64.exe" at offset 3757; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 3789; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 3821; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 3853; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 3885; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 3917; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 10368; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 15924; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 15932; code bytes = 8030 Found XOR loop in file "cls-magic2l_x64.exe" at offset 23092; code bytes = 8030 Found XOR loop in file "cls-magic2l_x86.exe" at offset 98437; code bytes = 33c1 Found XOR loop in file "cls-magic2l_x86.exe" at offset 248616; code bytes = 33c1 Found XOR loop in file "cls-magic2l_x86.exe" at offset 3693; code bytes = 8030 Found XOR loop in file "cls-magic2l_x86.exe" at offset 3725; code bytes = 8030 Found XOR loop in file "cls-magic2l_x86.exe" at offset 3757; code bytes = 8030 Found XOR loop in file "cls-magic2l_x86.exe" at offset 3789; code bytes = 8030 Found XOR loop in file "cls-magic2l_x86.exe" at offset 3821; code bytes = 8030 Found XOR loop in file "cls-magic2l_x86.exe" at offset 3853; code bytes = 8030 Found XOR loop in file "cls-magic2l_x86.exe" at offset 17076; code bytes = 8030 Found XOR loop in file "cls-srep_x64.exe" at offset 33546; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 34779; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 44095; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 45355; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 51130; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 51184; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 51238; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 51292; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 51330; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 148124; code bytes = 33c1 Found XOR loop in file "cls-srep_x64.exe" at offset 110651; code bytes = 8030 Found XOR loop in file "idp.dll" at offset 215029; code bytes = 30d0 Found XOR loop in file "idp.dll" at offset 216453; code bytes = 30d0 Found XOR loop in file "idp.dll" at offset 217911; code bytes = 30d0 Found XOR loop in file "idp.dll" at offset 218981; code bytes = 30d0 Found XOR loop in file "idp.dll" at offset 219509; code bytes = 30d0 Found XOR loop in file "idp.dll" at offset 220033; code bytes = 30d0 Found XOR loop in file "idp.dll" at offset 220467; code bytes = 30d0 Found XOR loop in file "idp.dll" at offset 86889; code bytes = 33c1 Found XOR loop in file "idp.dll" at offset 87488; code bytes = 33c1 Found XOR loop in file "idp.dll" at offset 159221; code bytes = 33c1 Found XOR loop in file "idp.dll" at offset 218966; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 28092; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 28104; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 28852; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 57397; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 111184; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 111283; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 111796; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 114467; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 118160; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 127117; code bytes = 8030 Found XOR loop in file "rz-1.03.7-stdio.exe" at offset 127196; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 28076; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 28088; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 28836; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 113008; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 113104; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 114484; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 120067; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 121536; code bytes = 8030 Found XOR loop in file "rz.exe" at offset 175576; code bytes = 8030 Found XOR loop in file "cls-srep_x86.exe" at offset 13427; code bytes = 30d0 Found XOR loop in file "cls-srep_x86.exe" at offset 25048; code bytes = 33c1 Found XOR loop in file "cls-srep_x86.exe" at offset 25226; code bytes = 33c1 Found XOR loop in file "cls-srep_x86.exe" at offset 25246; code bytes = 33c1 Found XOR loop in file "cls-srep_x86.exe" at offset 25296; code bytes = 33c1 Found XOR loop in file "cls-srep_x86.exe" at offset 44015; code bytes = 33c1 Found XOR loop in file "cls-srep_x86.exe" at offset 44153; code bytes = 33c1 Found XOR loop in file "cls-srep_x86.exe" at offset 40721; code bytes = 8030 Found XOR loop in file "cls-lollypop_x64.exe" at offset 1933; code bytes = 8030 Found XOR loop in file "cls-lollypop_x64.exe" at offset 1965; code bytes = 8030 Found XOR loop in file "cls-lollypop_x64.exe" at offset 1997; code bytes = 8030 Found XOR loop in file "cls-lollypop_x64.exe" at offset 2029; code bytes = 8030 Found XOR loop in file "cls-lollypop_x64.exe" at offset 2061; code bytes = 8030 Found XOR loop in file "cls-lollypop_x64.exe" at offset 2093; code bytes = 8030 Found XOR loop in file "cls-lollypop_x64.exe" at offset 8052; code bytes = 8030 Found XOR loop in file "cls-lollypop_x86.exe" at offset 89194; code bytes = 33c1 Found XOR loop in file "cls-lollypop_x86.exe" at offset 1933; code bytes = 8030 Found XOR loop in file "cls-lollypop_x86.exe" at offset 1965; code bytes = 8030 Found XOR loop in file "cls-lollypop_x86.exe" at offset 1997; code bytes = 8030 Found XOR loop in file "cls-lollypop_x86.exe" at offset 2029; code bytes = 8030 Found XOR loop in file "cls-lollypop_x86.exe" at offset 2061; code bytes = 8030 Found XOR loop in file "cls-lollypop_x86.exe" at offset 2093; code bytes = 8030 Found XOR loop in file "cls-lollypop_x86.exe" at offset 8052; code bytes = 8030 Found XOR loop in file "BASS.dll" at offset 69909; code bytes = 30d0 Found XOR loop in file "BASS.dll" at offset 74393; code bytes = 30d0 Found XOR loop in file "BASS.dll" at offset 37573; code bytes = 33c1 Found XOR loop in file "BASS.dll" at offset 54247; code bytes = 33c1 Found XOR loop in file "BASS.dll" at offset 70137; code bytes = 33c1 Found XOR loop in file "BASS.dll" at offset 92293; code bytes = 33c1 Found XOR loop in file "BASS.dll" at offset 51404; code bytes = 8030 Found XOR loop in file "innocallback.dll" at offset 43605; code bytes = 33c1 Found XOR loop in file "innocallback.dll" at offset 54306; code bytes = 8030 Found XOR loop in file "botva2.dll" at offset 35947; code bytes = 30d0 Found XOR loop in file "botva2.dll" at offset 35888; code bytes = 8030 Found XOR loop in file "cls-magic2l.dll" at offset 15977; code bytes = 30d0 Found XOR loop in file "cls-magic2l.dll" at offset 15938; code bytes = 8030 Found XOR loop in file "cls-lollypop.dll" at offset 15977; code bytes = 30d0 Found XOR loop in file "cls-lollypop.dll" at offset 15938; code bytes = 8030 Found XOR loop in file "rzw.exe" at offset 5035; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 17951; code bytes = 30d0 Found XOR loop in file "setup.tmp" at offset 261582; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 264179; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 281897; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 284076; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 290331; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 335056; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 339360; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 343253; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 348787; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 353910; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 357773; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 371518; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 658592; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 696900; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 787575; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 807214; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 835392; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 968104; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 992831; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 995074; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 1027557; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 1133801; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 1365783; code bytes = 8030 Found XOR loop in file "setup.tmp" at offset 1386971; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 50064; code bytes = 30d0 Found XOR loop in file "cls-magic2_x64.exe" at offset 314020; code bytes = 30d0 Found XOR loop in file "cls-magic2_x64.exe" at offset 129860; code bytes = 33c1 Found XOR loop in file "cls-magic2_x64.exe" at offset 138006; code bytes = 33c1 Found XOR loop in file "cls-magic2_x64.exe" at offset 138687; code bytes = 33c1 Found XOR loop in file "cls-magic2_x64.exe" at offset 149303; code bytes = 33c1 Found XOR loop in file "cls-magic2_x64.exe" at offset 150788; code bytes = 33c1 Found XOR loop in file "cls-magic2_x64.exe" at offset 274508; code bytes = 33c1 Found XOR loop in file "cls-magic2_x64.exe" at offset 3757; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 3789; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 3821; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 3853; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 3885; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 3917; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 10368; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 15924; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 15932; code bytes = 8030 Found XOR loop in file "cls-magic2_x64.exe" at offset 23092; code bytes = 8030 Found XOR loop in file "cls-magic2_x86.exe" at offset 98437; code bytes = 33c1 Found XOR loop in file "cls-magic2_x86.exe" at offset 248616; code bytes = 33c1 Found XOR loop in file "cls-magic2_x86.exe" at offset 3693; code bytes = 8030 Found XOR loop in file "cls-magic2_x86.exe" at offset 3725; code bytes = 8030 Found XOR loop in file "cls-magic2_x86.exe" at offset 3757; code bytes = 8030 Found XOR loop in file "cls-magic2_x86.exe" at offset 3789; code bytes = 8030 Found XOR loop in file "cls-magic2_x86.exe" at offset 3821; code bytes = 8030 Found XOR loop in file "cls-magic2_x86.exe" at offset 3853; code bytes = 8030 Found XOR loop in file "cls-magic2_x86.exe" at offset 17076; code bytes = 8030 Found XOR loop in file "cls-magic2.dll" at offset 15977; code bytes = 30d0 Found XOR loop in file "cls-magic2.dll" at offset 15938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229408; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 238198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 294899; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 299383; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 323098; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 329158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 363228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 467140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 521556; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 533934; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 575869; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 613900; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 662607; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 685918; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 803911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 910393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 968271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 978829; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 993818; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1021084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1030070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1120254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1127454; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1215061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1243971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1302998; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1326745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1489566; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1539947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1581105; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1595399; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1617191; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1631203; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1647709; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1817340; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2068108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2205772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2313647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2370084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2377902; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2380385; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2388006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2455212; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2492298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2502302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2532039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2542706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2643033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2806547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2811123; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2889863; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2967958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3213542; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3291353; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3321514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3331053; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3416546; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3466994; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3770260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4096944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4132309; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4199052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 176488; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 178533; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 214165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 217710; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 228784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 230261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 262563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 279237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 295127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 441056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 589953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 689442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 769716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 803527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 875059; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 886830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 955128; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1099462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1100484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1155577; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1247315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1796094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1880646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1889087; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1902320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2035318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2063359; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2110465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2165474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2300029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2356378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2394866; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2434091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2449971; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2463393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2464154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2506140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2589219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2603255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2653830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2669390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2684426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2716240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2749547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2965261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3015700; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3046013; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3096396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3172502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3192441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3211246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3288932; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3315515; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3423407; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3433280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3440832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3495397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3705688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3716756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3718700; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3743145; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3933766; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3973644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3976644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4005169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4064907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4199732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4201118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4243857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 95435; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 154769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 276394; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 331880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 335590; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 356368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 567645; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 607542; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 645889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 648063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 723587; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 806455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 842276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 856960; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 872862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 934258; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 993258; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1037667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1057199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1133241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1176356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1238324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1287210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1324198; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1351690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1367141; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1467521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1486489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1551043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1636332; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1639348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1667640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1688729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1724840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1820421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1852912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1927702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1938150; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2141788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2223411; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2308640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2416992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2419561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2483016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2805915; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2831644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2907013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3044184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3063103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3206214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3277847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3301570; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3426689; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3626375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3676595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3754030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3804835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3811827; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3813886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3817477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3908768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4106229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4120554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4154951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4181757; code bytes = 803028:T4ad,Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\FIFA 22_is1" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp, 00000000-00002812.00000001.298168.09F40000.00000004.mdmp, 00000000-00002812.00000002.300089.09F40000.00000004.mdmp, 00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp")29:T12b9,file/memory contains long string with (Indicator: "sendmessage"; File: "idp.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "botva2.dll") file/memory contains long string with (Indicator: "enumwindows"; File: "wintb.dll") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "setup.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "setup.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "setup.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "setup.exe") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "setup.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "setup.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp, 00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp, 00000000-00002812.00000001.298168.09F40000.00000004.mdmp, 00000000-00002812.00000002.300089.09F40000.00000004.mdmp, 00000000-00002812.00000003.307440.00401000.00000020.mdmp, 00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp, 00000000-00002812.00000001.298168.09F40000.00000004.mdmp, 00000000-00002812.00000002.300089.09F40000.00000004.mdmp, 00000000-00002812.00000003.307440.00401000.00000020.mdmp, 00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found reference to API "SENDMESSAGElN" (Indicator: "sendmessage"; Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp, 00000000-00002812.00000001.298168.09F40000.00000004.mdmp, 00000000-00002812.00000002.300089.09F40000.00000004.mdmp, 00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp, 00000000-00002812.00000001.298168.09F40000.00000004.mdmp, 00000000-00002812.00000002.300089.09F40000.00000004.mdmp, 00000000-00002812.00000003.307440.00401000.00000020.mdmp, 00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002812.00000002.300089.6B088000.00000004.mdmp")2a:T7f6,"setup.tmp" called "GetWindowTextW" with parameter "Select the language to use during the installation:" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "Limit installer to 3 GB of RAM usage" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "Welcome to the FIFA 22 Setup Wizard" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "This will install FIFA 22 on your computer.It is recommended that you close all other applications before continuing.Click" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "Information" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "Please read the following important information before continuing." - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "When you are ready to continue with Setup, click Next." - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "Select Destination Location" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "Where should FIFA 22 be installed?" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "&Don't create a Start Menu folder" - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "B&rowse..." - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "Setup will install FIFA 22 into the following folder." - (UID: 00000000-00002812) "setup.tmp" called "GetWindowTextW" with parameter "To continue, click Next. If you would like to select a different folder, click Browse." - (UID: 00000000-00002812)2b:T2264,"setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004208) "setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000018000000e284e8420000000098f10f010000000008f90f01a018ef7276851731feffffffb8f80f015c7fed7268f80f0127000000c4604100757fed72d0f80f01ffffffffffffffff2200000000000000d0f80f010000000000000000000000000000000000000000220000c0000000000100000000000000ffffffffffffffff102760e327000000c4604100e99c90770400000020000000843b4000d0f80f01933b4000c8f80f01b0f35205106d400001714000b0f3520500f90f0102c34000f4f80f01353b4000270000008861410014db40002e2e4000a163400010000000 (UID: 00000000-00004208) "setup.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004208) "setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004208) "setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000018000000143025cb0000000048f2af0000000000bcf9af00a018ef7250317ab9feffffff68f9af005c7fed7218f9af0099000000c4b05400757fed7280f9af00ffffffffffffffff220000000000000080f9af000000000000000000000000000000000000000000220000c0000000000100000000000000ffffffffffffffffdd3bc67199000000c4b05400e99c90770400000040f9af00200000001047400084f9af001f4740007cf9af00b0f3d30468ac400001ba4000b0f3d304b4f9af009a2c4100a8f9af00c14640009900000088b15400204741003a3040007188400010000000 (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000004c6f63616c650000000000000000000000000000000000000000000000000000010000000000000000010000000300000004000000010000000000000001cf6d6c0c4c43547970650000000000000000000000000000000000000000000000000000b46c400000000000090400000c0000008c3025cbbc3b5500a0f9af00a8224100090400000c0000003cf9af00020000002c0000008cf9af00563040008e54400088b1540009040000f1444100f94441001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b4f9af00f1b15400 (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060e24700c43d25cba0f9af00f0cfd57456304000655440009cf9af00829840008a984000f0b6540000003b7400000000d8f9af0074e14700 (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090854a00c43d25cba0f9af0050c3dd7356304000655440009cf9af00829840008a98400048b75400ec61550000000000d8f9af00c07e4a000000d87390854a005a000000 (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c4000001047400094f9af001f4740008cf9af0099000000c4ba54007c000000609ccf04990000004c2d507715c479759cf9af002c002e0064be54009cf9af0000000000d8f9af0005be5400 (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005475043c25cb0f00000064f9af0040425775563040006554400060f9af00829840008a984000205924770000237700000000b4f9af0097da4e000000547588db4e0001000000090000000010000000000100fffffeff0300000002000000d8210000000001000600004f (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002812) "setup.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000e5025005e271000000002a000874fc8601742a000874fb8c8f770000000000000000fc86017450f4af000000000000000000000000002a00087409000000a05fe50209000000fc860174000000005005e27118000000543b25cb6804000008edaf000000ee0224f6af00a018ef7250317ab9feffffff10f4af005a9bed72c0f3af000000000000000000739bed723cf4af000000000000000000000000000000000000000000000000000100000000000000010000000000000038f4af000000000048f4af00000000003cf4af000000000000000000000000004b00c9744c3b25cb50f4af0084da6577ad36c67154f4af00dab965770000d97148f4af00 (UID: 00000000-00002812)2c:T45d,"setup.tmp" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000030333933322c373834382c362c6c7056657273696f6e496e666f726d6174696f6e2c302c312c302c406166656638302c3237362c323430313030303030613030303030303030303030303030616233663030303030323030303030303030303030303030303030303030303030303030303030303030303030303030303030 (UID: 00000000-00002812) "setup.tmp" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000f1af00ea22fa05f122fa058cccfa05050000003cf1af000000000050f1af00b225fa052633fa050d00000009040000ae83fa05b683fa05050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064f1af00 (UID: 00000000-00002812) "setup.tmp" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002812)2d:T4f2,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "setup.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "setup.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "setup.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "setup.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp")2e:Ted7,Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "setup.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "setup.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "setup.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found reference to API "76622710052,7848,109,,GetWindowTextW,user32.dll,"01:17:36.031",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76601832477,7848,109,,GetWindowTextW,user32.dll,"01:17:36.015",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "150046461129,7848,107,,GetActiveWindow,user32.dll,"01:18:06.625",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "151932870924,7848,109,,GetWindowTextW,user32.dll,"01:18:07.406",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "150081510284,7848,109,,GetWindowTextW,user32.dll,"01:18:06.640",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "151933416460,7848,109,,GetWindowTextW,user32.dll,"01:18:07.406",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "151956824012,7848,109,,GetWindowTextW,user32.dll,"01:18:07.421",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002812.00000002.300089.6B088000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "403052101294,7848,107,,GetActiveWindow,user32.dll,"01:19:52.046",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "403068015170,7848,109,,GetWindowTextW,user32.dll,"01:19:52.046",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "403068969902,7848,109,,GetWindowTextW,user32.dll,"01:19:52.046",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp")2f:T541,file/memory contains long string(File: "ISDone.dll") file/memory contains long string(File: "idp.dll") file/memory contains long string(File: "rz-1.03.7-stdio.exe") file/memory contains long string(File: "rz.exe") file/memory contains long string(File: "cls-srep_x86.exe") file/memory contains long string(File: "cls-lollypop_x64.exe") file/memory contains long string(File: "cls-lollypop_x86.exe") file/memory contains long string(File: "innocallback.dll") file/memory contains long string(File: "botva2.dll") file/memory contains long string(File: "FlushFileCache.exe") file/memory contains long string(File: "_setup64.tmp") Found string "GetCommandLineW" (Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.05FAD000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000001.298168.05FAD000.00000004.mdmp, 00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004208.00000000.296154.00417000.00000004.mdmp")30:Tdcf,"setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004208) "setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004208) "setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004208) "setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004208) "setup.exe" called "LoadLibrary" with a parameter C:\setup.ENU (UID: 00000000-00004208) "setup.exe" called "LoadLibrary" with a parameter C:\setup.EN (UID: 00000000-00004208) "setup.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004208) "setup.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-BAMKF.tmp\setup.ENU (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-BAMKF.tmp\setup.EN (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter Rstrtmgr.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\idp.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\innocallback.ENU (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\innocallback.EN (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\innocallback.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\ISDone.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter MSFTEDIT.DLL (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter Dwmapi.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\wintb.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\BASS.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter dsound (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\callbackctrl.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter GDIPlus (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\botva2.dll (UID: 00000000-00002812) "setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-MBTN5.tmp\CallbackCtrl.dll (UID: 00000000-00002812)31:Ta8a3,"setup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00004208) "setup.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004208) "setup.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WINNLSEnableIME (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpAddFile (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpAddFileComp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpAddMirror (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpClearFiles (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpFilesCount (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpFileDownloaded (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpFilesDownloaded (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpDownloadFile (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpDownloadFiles (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpDownloadFilesComp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpDownloadFilesCompUi (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpStartDownload (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpStopDownload (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpSetLogin (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpSetProxyMode (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpSetProxyName (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpSetProxyLogin (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpConnectControl (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpAddMessage (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpSetInternalOption (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpSetDetailedMode (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpSetComponents (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpReportError (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpTrace (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpAddFileSize32 (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpGetFileSize32 (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter idpGetFilesSize32 (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter wrapcallback (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ISDoneInit (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ISDoneStop (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SuspendProc (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ResumeProc (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DwmRegisterThumbnail (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DwmUpdateThumbnailProperties (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WintbStart (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetTaskBarProgressValue (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetTaskBarProgressState (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter QueueUserAPC (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetThreadAffinityMask (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter SetThreadPriority (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FreeLibraryAndExitThread (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter mixerGetLineControlsA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter mixerGetNumDevs (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter mixerGetDevCapsA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter mixerOpen (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter mixerSetControlDetails (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter mixerGetControlDetailsA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter mixerClose (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter mixerGetLineInfoA (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter acmStreamSize (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter acmStreamPrepareHeader (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter acmStreamConvert (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter acmStreamUnprepareHeader (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter acmStreamClose (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter acmStreamOpen (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ceil (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strstr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strpbrk (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter qsort (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _stricmp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter floor (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ldexp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter memchr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strcat (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _strnicmp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _adjust_fdiv (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _CIpow (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _wcsdup (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter malloc (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter realloc (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter free (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _strdup (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _ftol (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter _CIexp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ??3@YAXPAX@Z (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter memset (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter memmove (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter ??2@YAPAXI@Z (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strchr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strtoul (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter strlen (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BASS_Init (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DirectSoundEnumerateW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter DirectSoundCaptureEnumerateW (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BASS_Start (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BASS_StreamCreateFile (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BASS_ChannelPlay (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BASS_ChannelGetLength (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BASS_ChannelBytes2Seconds (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter wrapcallbackaddr (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BASS_ChannelSetAttribute (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipLoadImageFromFile (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipCreateBitmapFromGraphics (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipCreateFromHWND (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipGraphicsClear (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipDrawImageRectRectI (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipCreateImageAttributes (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipSetImageAttributesColorMatrix (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipDisposeImageAttributes (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipResetClip (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipCloneBitmapAreaI (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipDrawImageRectRect (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BtnCreate (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BtnSetEvent (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00002812) "setup.tmp" called "GetProcAddress" with a parameter BASS_ChannelIsActive (UID: 00000000-00002812)32:T52a,Found reference to API "MoveFileExA" (Indicator: "MoveFile"; File: "setup.exe") Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "setup.exe") Found reference to API "MoveFileEx" (Indicator: "MoveFile"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "MoveFileEx" (Indicator: "MoveFile"; Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp")33:T5d8,file/memory contains long string with (Indicator: "CreateThread"; File: "cls-lollypop.dll") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "setup.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "setup.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "setup.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "setup.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "setup.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp")34:T750,"razor.dll" contains export function called "TMethodImplementationIntercept" at ordinal 3 "razor.dll" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "razor.dll" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "razor.dll" contains export function called "timeGetTime" at ordinal 4 "ISDone.dll" contains export function called "ChangeLanguage" at ordinal 6 "ISDone.dll" contains export function called "Exec2" at ordinal 13 "ISDone.dll" contains export function called "FileSearchInit" at ordinal 14 "ISDone.dll" contains export function called "IS7zipExtract" at ordinal 20 "ISDone.dll" contains export function called "ISArcExtract" at ordinal 21 "ISDone.dll" contains export function called "ISDoneInit" at ordinal 2 "ISDone.dll" contains export function called "ISDoneStop" at ordinal 1 "ISDone.dll" contains export function called "ISExec" at ordinal 8 "ISDone.dll" contains export function called "ISFindFiles" at ordinal 12 "ISDone.dll" contains export function called "ISFindFree" at ordinal 9 "ISDone.dll" contains export function called "ISGetName" at ordinal 10 "ISDone.dll" contains export function called "ISPackZIP" at ordinal 18 "ISDone.dll" contains export function called "ISPickFilename" at ordinal 11 "ISDone.dll" contains export function called "ISbinkExtract" at ordinal 17 "ISDone.dll" contains export function called "ISxDeltaExtract" at ordinal 19 "ISDone.dll" contains export function called "PrecompInit" at ordinal 15 "ISDone.dll" contains export function called "ResumeProc" at ordinal 4 "ISDone.dll" contains export function called "ShowChangeDiskWindow" at ordinal 7 "ISDone.dll" contains export function called "SrepInit" at ordinal 16 "ISDone.dll" contains export function called "SuspendProc" at ordinal 5 "ISDone.dll" contains export function called "wrapcallback" at ordinal 335:T1b66,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002812.00000000.296248.02E30000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002812.00000000.296248.02E30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\" in Source: 00000000-00002812.00000000.296248.04C40000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002812.00000000.296248.05FA1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00002812.00000000.296248.05FA1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00002812.00000000.296248.05FA1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\FIFA 22_is1" in Source: 00000000-00002812.00000000.296248.09F40000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002812.00000001.298168.02E30000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002812.00000001.298168.02E30000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002812.00000001.298168.02E30000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-" in Source: 00000000-00002812.00000001.298168.02E30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\" in Source: 00000000-00002812.00000001.298168.04C40000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002812.00000001.298168.06501000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\FIFA 22_is1" in Source: 00000000-00002812.00000001.298168.09F40000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002812.00000001.298168.72631000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00002812.00000001.298168.72631000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00002812.00000001.298168.72631000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00002812.00000001.298168.72631000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002812.00000002.300089.0055D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002812.00000002.300089.0055D000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002812.00000002.300089.0055D000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00002812.00000002.300089.0055D000.00000002.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002812.00000002.300089.02E30000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002812.00000002.300089.02E30000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002812.00000002.300089.02E30000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-" in Source: 00000000-00002812.00000002.300089.02E30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\" in Source: 00000000-00002812.00000002.300089.04C40000.00000004.mdmp "SOFTWARE\Borland\Delphi\RTL" in Source: 00000000-00002812.00000002.300089.06131000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\FIFA 22_is1" in Source: 00000000-00002812.00000002.300089.09F40000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002812.00000003.307440.02E30000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002812.00000003.307440.02E30000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002812.00000003.307440.02E30000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-" in Source: 00000000-00002812.00000003.307440.02E30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\" in Source: 00000000-00002812.00000003.307440.04C40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\FIFA 22_is1" in Source: 00000000-00002812.00000003.307440.09F40000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00004208.00000002.299996.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00004208.00000002.299996.00401000.00000020.mdmp36:Tfaf,"setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77570000 "setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77570000 "setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77570000 "setup.exe" loaded module "KERNEL32" at base 77230000 "setup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e50000 "setup.exe" loaded module "SHELL32.DLL" at base 75d80000 "setup.exe" loaded module "COMCTL32.DLL" at base 72f20000 "setup.exe" loaded module "KERNEL32.DLL" at base 77230000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d80000 "setup.exe" loaded module "NTDLL.DLL" at base 778b0000 "setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74220000 "setup.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77570000 "setup.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77570000 "setup.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77570000 "setup.tmp" loaded module "KERNEL32" at base 77230000 "setup.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e50000 "setup.tmp" loaded module "IMM32.DLL" at base 74380000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d80000 "setup.tmp" loaded module "KERNEL32.DLL" at base 77230000 "setup.tmp" loaded module "UXTHEME.DLL" at base 73d80000 "setup.tmp" loaded module "SHELL32.DLL" at base 75d80000 "setup.tmp" loaded module "OLEAUT32.DLL" at base 770c0000 "setup.tmp" loaded module "RPCRT4.DLL" at base 77790000 "setup.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75780000 "setup.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75780000 "setup.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74d00000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 773b0000 "setup.tmp" loaded module "SHFOLDER.DLL" at base 72a10000 "setup.tmp" loaded module "RSTRTMGR.DLL" at base 729e0000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77850000 "setup.tmp" loaded module "%TEMP%\IS-MBTN5.TMP\IDP.DLL" at base 10000000 "setup.tmp" loaded module "%TEMP%\IS-MBTN5.TMP\INNOCALLBACK.DLL" at base 5fa0000 "setup.tmp" loaded module "USER32.DLL" at base 75780000 "setup.tmp" loaded module "%TEMP%\IS-MBTN5.TMP\ISDONE.DLL" at base 6130000 "setup.tmp" loaded module "COMCTL32" at base 72f20000 "setup.tmp" loaded module "COMCTL32.DLL" at base 72f20000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 743b0000 "setup.tmp" loaded module "DWMAPI.DLL" at base 73280000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73280000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 75ab0000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75d80000 "setup.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72630000 "setup.tmp" loaded module "MSFTEDIT.DLL" at base 72380000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 72240000 "setup.tmp" loaded module "%TEMP%\IS-MBTN5.TMP\WINTB.DLL" at base 6b080000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 71950000 "setup.tmp" loaded module "%TEMP%\IS-MBTN5.TMP\BASS.DLL" at base 11000000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\DSOUND.DLL" at base 72140000 "setup.tmp" loaded module "DSOUND" at base 72140000 "setup.tmp" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 720e0000 "setup.tmp" loaded module "%TEMP%\IS-MBTN5.TMP\CALLBACKCTRL.DLL" at base 64e0000 "setup.tmp" loaded module "GDIPLUS" at base 74010000 "setup.tmp" loaded module "%TEMP%\IS-MBTN5.TMP\BOTVA2.DLL" at base 6500000 "setup.tmp" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 74010000 "setup.tmp" loaded module "WINDOWSCODECS.DLL" at base 71d90000 "setup.tmp" loaded module "NTDLL.DLL" at base 778b000037:T12fe,"setup.exe" was detected as "Inno Setup Module" and name: "Installer" "setup.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "setup.exe" was detected as "Turbo Linker" and name: "Linker" "razor.dll" was detected as "Inno Setup Module" and name: "Installer" "razor.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "razor.dll" was detected as "Turbo Linker" and name: "Linker" "ISDone.dll" was detected as "Inno Setup Module" and name: "Installer" "ISDone.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "ISDone.dll" was detected as "Turbo Linker" and name: "Linker" "cls-magic2l_x64.exe" was detected as "Inno Setup Module" and name: "Installer" "cls-magic2l_x64.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "cls-magic2l_x64.exe" was detected as "Turbo Linker" and name: "Linker" "cls-magic2l_x86.exe" was detected as "Inno Setup Module" and name: "Installer" "cls-magic2l_x86.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "cls-magic2l_x86.exe" was detected as "Turbo Linker" and name: "Linker" "cls-srep_x64.exe" was detected as "Inno Setup Module" and name: "Installer" "cls-srep_x64.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "cls-srep_x64.exe" was detected as "Turbo Linker" and name: "Linker" "idp.dll" was detected as "Inno Setup Module" and name: "Installer" "idp.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "idp.dll" was detected as "Turbo Linker" and name: "Linker" "rz-1.03.7-stdio.exe" was detected as "Inno Setup Module" and name: "Installer" "rz-1.03.7-stdio.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "rz-1.03.7-stdio.exe" was detected as "Turbo Linker" and name: "Linker" "rz.exe" was detected as "Inno Setup Module" and name: "Installer" "rz.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "rz.exe" was detected as "Turbo Linker" and name: "Linker" "cls-srep_x86.exe" was detected as "Inno Setup Module" and name: "Installer" "cls-srep_x86.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "cls-srep_x86.exe" was detected as "Turbo Linker" and name: "Linker" "cls-lollypop_x64.exe" was detected as "Inno Setup Module" and name: "Installer" "cls-lollypop_x64.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "cls-lollypop_x64.exe" was detected as "Turbo Linker" and name: "Linker" "cls-lollypop_x86.exe" was detected as "Inno Setup Module" and name: "Installer" "cls-lollypop_x86.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "cls-lollypop_x86.exe" was detected as "Turbo Linker" and name: "Linker" "BASS.dll" was detected as "Inno Setup Module" and name: "Installer" "BASS.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "BASS.dll" was detected as "Turbo Linker" and name: "Linker" "innocallback.dll" was detected as "Inno Setup Module" and name: "Installer" "innocallback.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "innocallback.dll" was detected as "Turbo Linker" and name: "Linker" "botva2.dll" was detected as "Inno Setup Module" and name: "Installer" "botva2.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "botva2.dll" was detected as "Turbo Linker" and name: "Linker" "hosts.exe" was detected as "Inno Setup Module" and name: "Installer" "hosts.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "hosts.exe" was detected as "Turbo Linker" and name: "Linker" "FlushFileCache.exe" was detected as "Inno Setup Module" and name: "Installer" "FlushFileCache.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "FlushFileCache.exe" was detected as "Turbo Linker" and name: "Linker" "cls-magic2l.dll" was detected as "Inno Setup Module" and name: "Installer" "cls-magic2l.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "cls-magic2l.dll" was detected as "Turbo Linker" and name: "Linker" "cls-lollypop.dll" was detected as "Inno Setup Module" and name: "Installer" "cls-lollypop.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "cls-lollypop.dll" was detected as "Turbo Linker" and name: "Linker" "wintb.dll" was detected as "Inno Setup Module" and name: "Installer" "wintb.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "wintb.dll" was detected as "Turbo Linker" and name: "Linker" "rzw.exe" was detected as "Inno Setup Module" and name: "Installer" "rzw.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "rzw.exe" was detected as "Turbo Linker" and name: "Linker" "CallbackCtrl.dll" was detected as "Inno Setup Module" and name: "Installer" "CallbackCtrl.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "CallbackCtrl.dll" was detected as "Turbo Linker" and name: "Linker"38:T55a,"setup.exe" has an executable section named ".text" "setup.exe" has an executable section named ".itext" "razor.dll" has an executable section named "UPX0" "razor.dll" has an executable section named "UPX1" "ISDone.dll" has an executable section named "CODE" "cls-magic2l_x64.exe" has an executable section named ".text" "cls-magic2l_x86.exe" has an executable section named ".text" "cls-srep_x64.exe" has an executable section named ".text" "idp.dll" has an executable section named ".text" "rz-1.03.7-stdio.exe" has an executable section named ".text" "rz.exe" has an executable section named ".text" "cls-srep_x86.exe" has an executable section named ".text" "cls-srep_x86.exe" has an executable section named ".text1" "cls-lollypop_x64.exe" has an executable section named ".text" "cls-lollypop_x86.exe" has an executable section named ".text" "BASS.dll" has an executable section named "" "innocallback.dll" has an executable section named "CODE" "botva2.dll" has an executable section named "CODE" "hosts.exe" has an executable section named ".text" "FlushFileCache.exe" has an executable section named ".text" "FlushFileCache.exe" has an executable section named ".itext" "cls-magic2l.dll" has an executable section named ".text" "cls-lollypop.dll" has an executable section named ".text" "wintb.dll" has an executable section named ".text"39:T537,"setup.exe" has an writable section named ".data" "setup.exe" has an writable section named ".bss" "setup.exe" has an writable section named ".idata" "setup.exe" has an writable section named ".tls" "razor.dll" has an writable section named "UPX0" "razor.dll" has an writable section named "UPX1" "razor.dll" has an writable section named ".rsrc" "ISDone.dll" has an writable section named "DATA" "ISDone.dll" has an writable section named "BSS" "ISDone.dll" has an writable section named ".idata" "cls-magic2l_x64.exe" has an writable section named ".text" "cls-magic2l_x86.exe" has an writable section named ".text" "cls-srep_x64.exe" has an writable section named ".data" "cls-srep_x64.exe" has an writable section named ".data1" "idp.dll" has an writable section named ".data" "rz-1.03.7-stdio.exe" has an writable section named ".data" "rz-1.03.7-stdio.exe" has an writable section named ".bss" "rz-1.03.7-stdio.exe" has an writable section named ".idata" "rz-1.03.7-stdio.exe" has an writable section named ".CRT" "rz-1.03.7-stdio.exe" has an writable section named ".tls" "rz.exe" has an writable section named ".data" "rz.exe" has an writable section named ".bss" "rz.exe" has an writable section named ".idata" "rz.exe" has an writable section named ".CRT" "rz.exe" has an writable section named ".tls"3a:T3a88,"setup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x5c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x3c], eax,mov dword ptr [ebp - 0x40], eax,mov dword ptr [ebp - 0x5c], eax,mov dword ptr [ebp - 0x30], eax,mov dword ptr [ebp - 0x38], eax,mov dword ptr [ebp - 0x34], eax,mov dword ptr [ebp - 0x2c], eax,mov dword ptr [ebp - 0x28], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4152b8,call 0x406854,xor eax, eax,push ebp,push 0x416b45,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x416b01,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x41ab48],call 0x415124,call 0x414cd0,lea edx, [ebp - 0x14],xor eax, eax," "razor.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rcx,mov qword ptr [rsp + 0x10], rdx,mov qword ptr [rsp + 0x18], r8,cmp dl, 1,jne 0x5c3480,push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x60223],lea rdi, [rsi - 0x162000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x5c3288,add ebx, ebx,je 0x5c323e,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x5c3276,cmp rbp, -4,ja 0x5c3276,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4," "ISDone.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x3c,mov eax, 0x41f2e4,call 0x405a38,call 0x40404c,lea eax, [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "cls-magic2l_x64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140043bdc,add rsp, 0x28,jmp 0x140043798,int3 ,int3 ,sub rsp, 0x28,call 0x140044128,test eax, eax,je 0x140043956,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x140043949,cmp rcx, rax,je 0x14004395d,xor eax, eax,lock cmpxchg qword ptr [rip + 0xffd4], rcx,jne 0x140043944,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x140043958,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,movzx eax, byte ptr [rip + 0xffbf],test ecx, ecx,mov ebx, 1," "cls-magic2l_x86.exe" file has an entrypoint instructions - "call 0x43d72c,jmp 0x43d2b9,push ebp,mov ebp, esp,mov eax, dword ptr [0x403098],and eax, 0x1f,push 0x20,pop ecx,sub ecx, eax,mov eax, dword ptr [ebp + 8],ror eax, cl,xor eax, dword ptr [0x403098],pop ebp,ret ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x43d49d,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x43d496,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x43d4a2,add edx, 0x28,cmp edx, esi,jne 0x43d487,xor eax, eax," "cls-srep_x64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140024e2c,add rsp, 0x28,jmp 0x14001cb48,int3 ,int3 ,sub rsp, 0x28,mov rcx, qword ptr [rip + 0x23235],call qword ptr [rip + 0xf3df],test rax, rax,je 0x14001cd20,call rax,mov edx, 1,xor ecx, ecx,call 0x140024fcc,call 0x140024fe8,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],mov rax, rcx,neg rcx," "idp.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x1001514e,call 0x1001d28d,push dword ptr [esp + 4],mov ecx, dword ptr [esp + 0x10],mov edx, dword ptr [esp + 0xc],call 0x1001504c,pop ecx,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x100151a0,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x100151d3,test ecx, 3,jne 0x1001517c,add eax, 0,lea esp, [esp],lea esp, [esp],mov eax, dword ptr [ecx]," "rz-1.03.7-stdio.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x2b865],mov dword ptr [rax], 0,call 0x426f30,call 0x4011b0,nop ,nop ,add rsp, 0x28,ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rbp,mov rbp, rsp,lea rcx, [rip + 0x15],pop rbp,jmp 0x426e20,nop dword ptr [rax + rax],nop word ptr cs:[rax + rax],push rbp,mov rbp, rsp,pop rbp,ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rsi,push rbx," "rz.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x2ab15],mov dword ptr [rax], 0,call 0x426890,call 0x4011b0,nop ,nop ,add rsp, 0x28,ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rbp,mov rbp, rsp,lea rcx, [rip + 0x15],pop rbp,jmp 0x426780,nop word ptr cs:[rax + rax],push rbp,mov rbp, rsp,pop rbp,ret ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,push rsi,push rbx," "cls-srep_x86.exe" file has an entrypoint instructions - "call 0x413e1f,jmp 0x40c75b,push dword ptr [0x44dca0],call dword ptr [0x41d084],test eax, eax,je 0x40c8f2,call eax,push 1,push 0,call 0x413f48,pop ecx,pop ecx,jmp 0x413f67,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push edi,push esi,mov esi, dword ptr [esp + 0x10],mov ecx, dword ptr [esp + 0x14],mov edi, dword ptr [esp + 0xc],mov eax, ecx,mov edx, ecx,add eax, esi,cmp edi, esi,jbe 0x40c930,cmp edi, eax,jb 0x40cc98,bt dword ptr [0x44dce8], 1,jae 0x40c941," "cls-lollypop_x64.exe" file has an entrypoint instructions - "push r15,push rbp,sub rsp, 0x28,call qword ptr [rip + 0x1ad53],mov r15, rax,call qword ptr [rip + 0x1adca],mov rcx, rax,xor edx, edx,mov r8d, 0x1000,call qword ptr [rip + 0x1ae41],mov rbp, rax,mov r9, rbp,xor ecx, ecx,mov r10b, byte ptr [r15],cmp r10b, 0x20,jne 0x140008328,inc r15,mov r10b, byte ptr [r15],cmp r10b, 0x20,jne 0x140008328,inc r15,mov r10b, byte ptr [r15],cmp r10b, 0x20,jne 0x140008328,inc r15,mov r10b, byte ptr [r15],cmp r10b, 0x20,jne 0x140008328,inc r15,mov r10b, byte ptr [r15]," "cls-lollypop_x86.exe" file has an entrypoint instructions - "sub esp, 8,call dword ptr [0x420010],mov ebp, eax,call dword ptr [0x420050],push 0x800,push 0,push eax,call dword ptr [0x420094],mov ebx, eax,mov esi, ebx,xor eax, eax,movsx edi, byte ptr [ebp],cmp edi, 0x20,jne 0x408296,inc ebp,movsx edi, byte ptr [ebp],cmp edi, 0x20,jne 0x408296,inc ebp,movsx edi, byte ptr [ebp],cmp edi, 0x20,jne 0x408296,inc ebp,movsx edi, byte ptr [ebp],cmp edi, 0x20,jne 0x408296,inc ebp,movsx edi, byte ptr [ebp],cmp edi, 0x20,je 0x40828c,jl 0x408323,cmp edi, 0x22,je 0x408306,mov ecx, ebp," "BASS.dll" file has an entrypoint instructions - "mov eax, 0x1104b000,pushf ,pushal ,push eax,mov ebx, eax,add eax, dword ptr [eax],push 0x15e30,push 0,call dword ptr [eax + 0x1c],mov dword ptr [ebx + 8], eax,push 0x11000000,mov edi, dword ptr [esp],mov esi, dword ptr [ebx],add di, 0x780,lea esi, [esi + ebx + 8],mov dword ptr [ebx], edi,push ebx,mov ebx, dword ptr [esi + 0x10],mov eax, 0x880,push esi,push 2,push eax,push edi,push 0x11,push 0xa,push esi,push 4,push eax,push edi,call ebx,sub esi, 8,pop ecx,rep movsd dword ptr es:[edi], dword ptr [esi],pop ecx,add di, 0x58,add esi, 0xd0,rep movsd dword ptr es:[edi], dword ptr [esi],call ebx,pop eax,lea edx, [eax + 0x190]," "innocallback.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x4c,mov eax, 0x40cc84,call 0x405584,call 0x4031a4,lea eax, [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "botva2.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x3c,mov eax, 0x408058,call 0x403cc4,call 0x402f28,lea eax, [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "hosts.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "FlushFileCache.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x18,push ebx,push esi,xor eax, eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 0x18], eax,mov eax, dword ptr [0x4087d8],mov byte ptr [eax], 1,mov eax, 0x404dcc,call 0x404b50,xor eax, eax,push ebp,push 0x40742d,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,mov eax, dword ptr [0x4087d4],mov edx, 0x407448,call 0x403648,call 0x4036c0,call 0x402e58,call 0x403044,sub eax, 1,jb 0x40711b,je 0x407127,jmp 0x40714e,mov eax, 0x40bbac,call 0x40403c,jmp 0x40715d," "cls-magic2l.dll" file has an entrypoint instructions - "mov eax, 1,ret 0xc,nop dword ptr [eax + eax],jmp dword ptr [0x10001010],mov eax, dword ptr [esp + 4],mov ecx, eax,pxor xmm0, xmm0,and ecx, 0xf,and eax, 0xfffffff0,movdqa xmm1, xmmword ptr [eax],pcmpeqb xmm1, xmm0,pmovmskb edx, xmm1,shr edx, cl,shl edx, cl,bsf edx, edx,jne 0x100023ef,add eax, 0x10,movdqa xmm1, xmmword ptr [eax],pcmpeqb xmm1, xmm0,pmovmskb edx, xmm1,bsf edx, edx,je 0x100023db,sub eax, dword ptr [esp + 4],add eax, edx,ret ,push ebx,mov ecx, dword ptr [esp + 8],mov eax, ecx,and ecx, 3,je 0x1000242a," "cls-lollypop.dll" file has an entrypoint instructions - "mov eax, 1,ret 0xc,nop dword ptr [eax + eax],jmp dword ptr [0x10001010],mov eax, dword ptr [esp + 4],mov ecx, eax,pxor xmm0, xmm0,and ecx, 0xf,and eax, 0xfffffff0,movdqa xmm1, xmmword ptr [eax],pcmpeqb xmm1, xmm0,pmovmskb edx, xmm1,shr edx, cl,shl edx, cl,bsf edx, edx,jne 0x1000237f,add eax, 0x10,movdqa xmm1, xmmword ptr [eax],pcmpeqb xmm1, xmm0,pmovmskb edx, xmm1,bsf edx, edx,je 0x1000236b,sub eax, dword ptr [esp + 4],add eax, edx,ret ,push ebx,mov ecx, dword ptr [esp + 8],mov eax, ecx,and ecx, 3,je 0x100023ba," "wintb.dll" file has an entrypoint instructions - "sub esp, 0x2c,mov dword ptr [esp + 0x20], ebx,mov ebx, dword ptr [esp + 0x34],mov dword ptr [esp + 0x24], esi,mov esi, dword ptr [esp + 0x30],mov dword ptr [esp + 0x28], edi,mov edi, dword ptr [esp + 0x38],cmp ebx, 1,je 0x6b0810c4,mov dword ptr [esp + 8], edi,mov dword ptr [esp + 4], ebx,mov dword ptr [esp], esi,call 0x6b082420,sub esp, 0xc,test ebx, ebx,jne 0x6b0810b2,mov edx, dword ptr [0x6b086000],test edx, edx,je 0x6b081130,mov dword ptr [esp + 0x1c], eax,call 0x6b081000,mov eax, dword ptr [esp + 0x1c],mov ebx, dword ptr [esp + 0x20],mov esi, dword ptr [esp + 0x24],mov edi, dword ptr [esp + 0x28],add esp, 0x2c,ret 0xc," "rzw.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x403130,push 0x402000,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x20,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,and dword ptr [ebp - 4], 0,push 1,call dword ptr [0x403060],pop ecx,or dword ptr [0x44e010], 0xffffffff,or dword ptr [0x44e014], 0xffffffff,call dword ptr [0x403064],mov ecx, dword ptr [0x44e00c],mov dword ptr [eax], ecx,call dword ptr [0x403068],mov ecx, dword ptr [0x44e008],mov dword ptr [eax], ecx,mov eax, dword ptr [0x40306c],mov eax, dword ptr [eax]," "CallbackCtrl.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 0,jne 0x1000112a,mov eax, dword ptr [0x10003000],test eax, eax,je 0x1000112a,push esi,mov esi, eax,mov eax, dword ptr [eax + 4],push 0x8000,push 0,mov dword ptr [0x10003000], eax,push dword ptr [esi],call dword ptr [0x10002000],push esi,call dword ptr [0x1000200c],mov eax, dword ptr [0x10003000],pop ecx,test eax, eax,jne 0x100010ff,pop esi,push 1,pop eax,ret 0xc,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3b:T50b,"setup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ISDone.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cls-magic2l_x86.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "idp.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cls-srep_x86.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cls-lollypop_x86.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "BASS.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "innocallback.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "botva2.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "hosts.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "FlushFileCache.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cls-magic2l.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cls-lollypop.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "wintb.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "rzw.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "CallbackCtrl.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE3c:T14f2,"razor.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\razor.dll]- [targetUID: 00000000-00002812] "ISDone.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\ISDone.dll]- [targetUID: 00000000-00002812] "cls-magic2l_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l_x64.exe]- [targetUID: 00000000-00002812] "cls-magic2l_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l_x86.exe]- [targetUID: 00000000-00002812] "cls-srep_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-srep_x64.exe]- [targetUID: 00000000-00002812] "idp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\idp.dll]- [targetUID: 00000000-00002812] "rz-1.03.7-stdio.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 9 sections"- Location: [%TEMP%\is-MBTN5.tmp\rz-1.03.7-stdio.exe]- [targetUID: 00000000-00002812] "rz.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 9 sections"- Location: [%TEMP%\is-MBTN5.tmp\rz.exe]- [targetUID: 00000000-00002812] "cls-srep_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 6 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-srep_x86.exe]- [targetUID: 00000000-00002812] "cls-lollypop_x64.exe" has type "PE32+ executable for MS Windows 4.00 (console) x86-64 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop_x64.exe]- [targetUID: 00000000-00002812] "cls-lollypop_x86.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop_x86.exe]- [targetUID: 00000000-00002812] "BASS.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-MBTN5.tmp\BASS.dll]- [targetUID: 00000000-00002812] "innocallback.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\innocallback.dll]- [targetUID: 00000000-00002812] "botva2.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\botva2.dll]- [targetUID: 00000000-00002812] "hosts.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\hosts.exe]- [targetUID: 00000000-00002812] "FlushFileCache.exe" has type "PE32 executable for MS Windows 5.00 (console) Intel i386 8 sections"- Location: [%TEMP%\is-MBTN5.tmp\FlushFileCache.exe]- [targetUID: 00000000-00002812] "cls-magic2l.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l.dll]- [targetUID: 00000000-00002812] "cls-lollypop.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop.dll]- [targetUID: 00000000-00002812] "wintb.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%TEMP%\is-MBTN5.tmp\wintb.dll]- [targetUID: 00000000-00002812] "rzw.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\rzw.exe]- [targetUID: 00000000-00002812] "host.cmd" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%TEMP%\is-MBTN5.tmp\host.cmd]- [targetUID: 00000000-00002812] "CallbackCtrl.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\CallbackCtrl.dll]- [targetUID: 00000000-00002812] "music.mp3" has type "MPEG ADTS layer III v1 64 kbps 44.1 kHz JntStereo"- Location: [%TEMP%\is-MBTN5.tmp\music.mp3]- [targetUID: 00000000-00002812] "setup.tmp" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-BAMKF.tmp\setup.tmp]- [targetUID: 00000000-00004208] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002812] "arc.ini" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\is-MBTN5.tmp\arc.ini]- [targetUID: 00000000-00002812] "MusicButton.png" has type "PNG image data 36 x 288 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\is-MBTN5.tmp\MusicButton.png]- [targetUID: 00000000-00002812] "CLS.ini" has type "Generic INItialization configuration [Precomp]"- Location: [%TEMP%\is-MBTN5.tmp\CLS.ini]- [targetUID: 00000000-00002812] "cls-magic2_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2_x64.exe]- [targetUID: 00000000-00002812] "cls-magic2_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2_x86.exe]- [targetUID: 00000000-00002812] "cls-magic2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2.dll]- [targetUID: 00000000-00002812]3d:T54a,"setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")3e:T756,"razor.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\razor.dll]- [targetUID: 00000000-00002812] "ISDone.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\ISDone.dll]- [targetUID: 00000000-00002812] "idp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\idp.dll]- [targetUID: 00000000-00002812] "BASS.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-MBTN5.tmp\BASS.dll]- [targetUID: 00000000-00002812] "innocallback.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\innocallback.dll]- [targetUID: 00000000-00002812] "botva2.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\botva2.dll]- [targetUID: 00000000-00002812] "cls-magic2l.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l.dll]- [targetUID: 00000000-00002812] "cls-lollypop.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop.dll]- [targetUID: 00000000-00002812] "wintb.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%TEMP%\is-MBTN5.tmp\wintb.dll]- [targetUID: 00000000-00002812] "CallbackCtrl.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\CallbackCtrl.dll]- [targetUID: 00000000-00002812] "cls-magic2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2.dll]- [targetUID: 00000000-00002812]3f:T9be,"setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SETUP.EXE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")40:T92e,"setup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "setup.exe" trying to access non-existent file "C:\FLTLIB.DLL" "setup.exe" trying to access non-existent file "C:\SETUP.ENU.DLL" "setup.exe" trying to access non-existent file "C:\setup.ENU.DLL" "setup.exe" trying to access non-existent file "C:\SETUP.EN.DLL" "setup.exe" trying to access non-existent file "C:\setup.EN.DLL" "setup.exe" trying to access non-existent file "C:\NETMSG.DLL" "setup.exe" trying to access non-existent file "C:\netmsg.dll" "setup.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\MSIMG32.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\VERSION.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\MPR.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\IPHLPAPI.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\BCRYPT.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\FLTLIB.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\CRYPTSP.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\SETUP.ENU.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\setup.ENU.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\SETUP.EN.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\setup.EN.DLL" "setup.tmp" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "setup.tmp" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\NETMSG.DLL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\netmsg.dll" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\SHFOLDER.DLL"41:T808,"setup.exe" trying to access non-existent file "C:\SETUP.EXE.LOCAL" "setup.exe" trying to access non-existent file "C:\SETUP.ENU" "setup.exe" trying to access non-existent file "C:\setup.ENU" "setup.exe" trying to access non-existent file "C:\SETUP.EN" "setup.exe" trying to access non-existent file "C:\setup.EN" "setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-BAMKF.TMP" "setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\SETUP.TMP.LOCAL" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\WINSPOOL.DRV" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\SETUP.ENU" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\setup.ENU" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\SETUP.EN" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\setup.EN" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-MBTN5.TMP" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\INNOCALLBACK.ENU" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\innocallback.ENU" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\INNOCALLBACK.EN" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\innocallback.EN" "setup.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\setup.tmp.Local\"42:T930,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "setup.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "setup.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "setup.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "setup.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "setup.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "setup.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000003.307440.11001000.00000040.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000003.307440.11001000.00000040.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00002812.00000003.307440.11001000.00000040.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002812.00000003.307440.11001000.00000040.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002812.00000003.307440.11001000.00000040.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002812.00000003.307440.11001000.00000040.mdmp") Found reference to API "InternetReadFileExA" (Indicator: "InternetReadFile"; Source: "00000000-00002812.00000003.307440.11001000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002812.00000003.307440.11001000.00000040.mdmp")43:T8ac5,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00002812.00000000.296248.04C40000.00000004.mdmp") Found URL "http://bit.ly/fitgirl-repacks-sitefitgirlhttp://bit.ly/fitgirl-repacks-siteerror" - Source: "00000000-00002812.00000000.296248.04C40000.00000004.mdmp") Found URL "https://ru.riotpixels.com/games/fifa-21/openhttps://en.riotpixels.com/games/fifa-21/open" - Source: "00000000-00002812.00000000.296248.04C40000.00000004.mdmp") Found URL "http://us.download.nvidia.com/windows/9.13.1220/physx-9.13.1220-systemsoftware.msidotnet35" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/0/e/20e90413-712f-438c-988e-fdaa79a8ac3d/dotnetfx35.exedotnet35cp" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/c/d/c/cdc0f321-4f72-4a08-9bac-082f3692ecd9/dotnetfx35client.exedotnet4full" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/5/a/95a9616b-7a37-4af6-bc36-d6ea96c8daae/dotnetfx40_full_x86_x64.exedotnet451" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/7/167f0d79-9317-48ae-aedb-17120579f8e2/ndp451-kb2858728-x86-x64-allos-enu.exedotnet471" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/4312fa21-59b0-4451-9482-a1376f7f3ba4/9947fce13c11105b48cba170494e787f/ndp471-kb4033342-x86-x64-allos-enu.exedotnet48" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.exevc_2005_sp1_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/8/b/4/8b42259f-5d70-43f4-ac2e-4b208fd8d66a/vcredist_x86.exevc_2008_sp1_x64" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/5/d/8/5d8c65cb-c849-4025-8e95-c3966cafd8ae/vcredist_x64.exevc_2008_sp1_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/5/d/8/5d8c65cb-c849-4025-8e95-c3966cafd8ae/vcredist_x86.exevc_2010_sp1_x64" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x64.exevc_2010_sp1_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x86.exevc_2012_x64" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x64.exevc_2012_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x86.exevc_2013_x64" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/e/6/2e61cfa4-993b-4dd4-91da-3737cd5cd6e3/vcredist_x64.exevc_2013_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/e/6/2e61cfa4-993b-4dd4-91da-3737cd5cd6e3/vcredist_x86.exevc_2015_x64" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x64.exevc_2015_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x86.exevc_2017_x64" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/11100230/15ccb3f02745c7b206ad10373cbca89b/vc_redist.x64.exevc_2017_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/11100229/78c1e864d806e36f6035d80a0e80399e/vc_redist.x86.exevc_2019_x64" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/ee84fed2552e018e854d4cd2496df4dd516f30733a27901167b8a9882119e57c/vc_redist.x64.exevc_2019_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exevc_2022_x64" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://aka.ms/vs/17/release/vc_redist.x64.exevc_2022_x86" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://aka.ms/vs/17/release/vc_redist.x86.exebass.dllcls-lollypop.dllcls-lollypop_x64.execls-lollypop_x86.execls-srep_x64.execls-srep_x86.execls-magic2.dllcls-magic2_x64.execls-magic2_x86.execls-magic2l.dllcls-magic2l_x64.execls-magic2l_x86.exeflushfilecache.exearc.inicls.inicallbackctrl.dllbotva2.dllmusicbutton.pngmusic.mp3host.cmdhosts.exerz.exerzw.exerazor.dllrz-1.03.7-stdio.exe" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "http://bit.ly/fitgirl-repacks-siteopenc:\users\hapubws\appdata\local\temp\is-mbtn5.tmp\isdone.dll/verysilent/suppressmsgboxesc:\users\hapubws\appdata\local\temp\is-mbtn5.tmp\innocallback.dll" - Source: "00000000-00002812.00000000.296248.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/0/e/20e90413-712f-438c-988e-fdaa79a8ac3d/dotnetfx35.execal\pt" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "https://download.microsoft.com/download/c/d/c/cdc0f321-4f72-4a08-9bac-082f3692ecd9/dotnetfx35client.exe48_none_5d7c08dba7db7edd\:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\%nunarc.dll" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "http://us.download.nvidia.com/windows/9.13.1220/physx-9.13.1220-systemsoftware.msi:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/5/a/95a9616b-7a37-4af6-bc36-d6ea96c8daae/dotnetfx40_full_x86_x64.exehttps://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exes.sitefitgirl-repacks.site" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "http://fitgirl-repacks.site" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "http://fitgirl-repackyperlink" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "http://fitgirl-repacks.sitain" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.exe42-x86-x64-allos-enu.exec:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\gdiplus.dllstry\machine\software\classes\clsid\" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/4312fa21-59b0-4451-9482-a1376f7f3ba4/9947fce13c11105b48cba170494e787f/ndp471-kb4033342-x86-x64-allos-enu.exenot" - Source: "00000000-00002812.00000001.298168.04C40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exethis" - Source: "00000000-00002812.00000001.298168.04C40000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00002812.00000001.298168.04C40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.execurrent" - Source: "00000000-00002812.00000001.298168.04C40000.00000004.mdmp") Found URL "http://bit.ly/fitgirl-repacks-sitefitgirlhttp://bit.ly/fitgirl-repacks-sitewelcome" - Source: "00000000-00002812.00000001.298168.04C40000.00000004.mdmp") Found URL "https://ru.riotpixels.com/games/fifa-21/openhttps://en.riotpixels.com/games/fifa-21/open-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exe" - Source: "00000000-00002812.00000001.298168.04C40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x86.exe.execlick" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x86.exeselect" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "http://us.download.nvidia.com/windows/9.13.1220/physx-9.13.1220-systemsoftware.msidotnet35" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/0/e/20e90413-712f-438c-988e-fdaa79a8ac3d/dotnetfx35.exedotnet35cp" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/c/d/c/cdc0f321-4f72-4a08-9bac-082f3692ecd9/dotnetfx35client.exedotnet4full" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/5/a/95a9616b-7a37-4af6-bc36-d6ea96c8daae/dotnetfx40_full_x86_x64.exedotnet451" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/7/167f0d79-9317-48ae-aedb-17120579f8e2/ndp451-kb2858728-x86-x64-allos-enu.exedotnet471" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/4312fa21-59b0-4451-9482-a1376f7f3ba4/9947fce13c11105b48cba170494e787f/ndp471-kb4033342-x86-x64-allos-enu.exedotnet48" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.exevc_2005_sp1_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/8/b/4/8b42259f-5d70-43f4-ac2e-4b208fd8d66a/vcredist_x86.exevc_2008_sp1_x64" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/5/d/8/5d8c65cb-c849-4025-8e95-c3966cafd8ae/vcredist_x64.exevc_2008_sp1_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/5/d/8/5d8c65cb-c849-4025-8e95-c3966cafd8ae/vcredist_x86.exevc_2010_sp1_x64" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x64.exevc_2010_sp1_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x86.exevc_2012_x64" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x64.exevc_2012_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x86.exevc_2013_x64" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/e/6/2e61cfa4-993b-4dd4-91da-3737cd5cd6e3/vcredist_x64.exevc_2013_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/e/6/2e61cfa4-993b-4dd4-91da-3737cd5cd6e3/vcredist_x86.exevc_2015_x64" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x64.exevc_2015_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x86.exevc_2017_x64" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/11100230/15ccb3f02745c7b206ad10373cbca89b/vc_redist.x64.exevc_2017_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/11100229/78c1e864d806e36f6035d80a0e80399e/vc_redist.x86.exevc_2019_x64" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/ee84fed2552e018e854d4cd2496df4dd516f30733a27901167b8a9882119e57c/vc_redist.x64.exevc_2019_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exevc_2022_x64" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://aka.ms/vs/17/release/vc_redist.x64.exevc_2022_x86" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://aka.ms/vs/17/release/vc_redist.x86.exebass.dllcls-lollypop.dllcls-lollypop_x64.execls-lollypop_x86.execls-srep_x64.execls-srep_x86.execls-magic2.dllcls-magic2_x64.execls-magic2_x86.execls-magic2l.dllcls-magic2l_x64.execls-magic2l_x86.exeflushfilecache.exearc.inicls.inicallbackctrl.dllbotva2.dllmusicbutton.pngmusic.mp3host.cmdhosts.exerz.exerzw.exerazor.dllrz-1.03.7-stdio.exe" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "http://bit.ly/fitgirl-repacks-siteopen/verysilent/suppressmsgboxescheck" - Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/0/e/20e90413-712f-438c-988e-fdaa79a8ac3d/dotnetfx35.execal\pt" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "http://fitgirl-repacks.site" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "https://download.microsoft.com/download/c/d/c/cdc0f321-4f72-4a08-9bac-082f3692ecd9/dotnetfx35client.exe48_none_5d7c08dba7db7edd\:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\%nunarc.dll" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "http://us.download.nvidia.com/windows/9.13.1220/physx-9.13.1220-systemsoftware.msi:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/5/a/95a9616b-7a37-4af6-bc36-d6ea96c8daae/dotnetfx40_full_x86_x64.exehttps://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exes.sitefitgirl-repacks.site" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "http://fitgirl-repackyperlink" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "http://fitgirl-repacks.sitain" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.exe42-x86-x64-allos-enu.exec:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\gdiplus.dllstry\machine\software\classes\clsid\" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/4312fa21-59b0-4451-9482-a1376f7f3ba4/9947fce13c11105b48cba170494e787f/ndp471-kb4033342-x86-x64-allos-enu.exenot" - Source: "00000000-00002812.00000002.300089.04C40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exethis" - Source: "00000000-00002812.00000002.300089.04C40000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00002812.00000002.300089.04C40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.execurrent" - Source: "00000000-00002812.00000002.300089.04C40000.00000004.mdmp") Found URL "http://bit.ly/fitgirl-repacks-sitefitgirlhttp://bit.ly/fitgirl-repacks-sitewelcome" - Source: "00000000-00002812.00000002.300089.04C40000.00000004.mdmp") Found URL "https://ru.riotpixels.com/games/fifa-21/openhttps://en.riotpixels.com/games/fifa-21/open-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exe" - Source: "00000000-00002812.00000002.300089.04C40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x86.exe.execlick" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x86.exeselect" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "http://us.download.nvidia.com/windows/9.13.1220/physx-9.13.1220-systemsoftware.msidotnet35" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/0/e/20e90413-712f-438c-988e-fdaa79a8ac3d/dotnetfx35.exedotnet35cp" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/c/d/c/cdc0f321-4f72-4a08-9bac-082f3692ecd9/dotnetfx35client.exedotnet4full" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/5/a/95a9616b-7a37-4af6-bc36-d6ea96c8daae/dotnetfx40_full_x86_x64.exedotnet451" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/7/167f0d79-9317-48ae-aedb-17120579f8e2/ndp451-kb2858728-x86-x64-allos-enu.exedotnet471" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/4312fa21-59b0-4451-9482-a1376f7f3ba4/9947fce13c11105b48cba170494e787f/ndp471-kb4033342-x86-x64-allos-enu.exedotnet48" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.exevc_2005_sp1_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/8/b/4/8b42259f-5d70-43f4-ac2e-4b208fd8d66a/vcredist_x86.exevc_2008_sp1_x64" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/5/d/8/5d8c65cb-c849-4025-8e95-c3966cafd8ae/vcredist_x64.exevc_2008_sp1_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/5/d/8/5d8c65cb-c849-4025-8e95-c3966cafd8ae/vcredist_x86.exevc_2010_sp1_x64" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x64.exevc_2010_sp1_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x86.exevc_2012_x64" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x64.exevc_2012_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x86.exevc_2013_x64" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/e/6/2e61cfa4-993b-4dd4-91da-3737cd5cd6e3/vcredist_x64.exevc_2013_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/e/6/2e61cfa4-993b-4dd4-91da-3737cd5cd6e3/vcredist_x86.exevc_2015_x64" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x64.exevc_2015_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x86.exevc_2017_x64" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/11100230/15ccb3f02745c7b206ad10373cbca89b/vc_redist.x64.exevc_2017_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/11100229/78c1e864d806e36f6035d80a0e80399e/vc_redist.x86.exevc_2019_x64" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/ee84fed2552e018e854d4cd2496df4dd516f30733a27901167b8a9882119e57c/vc_redist.x64.exevc_2019_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exevc_2022_x64" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://aka.ms/vs/17/release/vc_redist.x64.exevc_2022_x86" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "https://aka.ms/vs/17/release/vc_redist.x86.exebass.dllcls-lollypop.dllcls-lollypop_x64.execls-lollypop_x86.execls-srep_x64.execls-srep_x86.execls-magic2.dllcls-magic2_x64.execls-magic2_x86.execls-magic2l.dllcls-magic2l_x64.execls-magic2l_x86.exeflushfilecache.exearc.inicls.inicallbackctrl.dllbotva2.dllmusicbutton.pngmusic.mp3host.cmdhosts.exerz.exerzw.exerazor.dllrz-1.03.7-stdio.exe" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "http://bit.ly/fitgirl-repacks-siteopen/verysilent/suppressmsgboxescheck" - Source: "00000000-00002812.00000002.300089.09F40000.00000004.mdmp") Found URL "http://www.innosetup.com/remobjects" - Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found URL "http://www.remobjects.com/psenhanced" - Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found URL "http://restools.hanzify.org/exception" - Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found URL "https://download.microsoft.com/download/2/0/e/20e90413-712f-438c-988e-fdaa79a8ac3d/dotnetfx35.execal\pt" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "http://fitgirl-repacks.site" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "https://download.microsoft.com/download/c/d/c/cdc0f321-4f72-4a08-9bac-082f3692ecd9/dotnetfx35client.exe48_none_5d7c08dba7db7edd\:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\%nunarc.dll" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "http://us.download.nvidia.com/windows/9.13.1220/physx-9.13.1220-systemsoftware.msi:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/5/a/95a9616b-7a37-4af6-bc36-d6ea96c8daae/dotnetfx40_full_x86_x64.exehttps://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exes.sitefitgirl-repacks.site" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "http://fitgirl-repackyperlink" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "http://fitgirl-repacks.sitain" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.exe42-x86-x64-allos-enu.exec:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\gdiplus.dllstry\machine\software\classes\clsid\" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/4312fa21-59b0-4451-9482-a1376f7f3ba4/9947fce13c11105b48cba170494e787f/ndp471-kb4033342-x86-x64-allos-enu.exenot" - Source: "00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exethis" - Source: "00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.execurrent" - Source: "00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found URL "http://bit.ly/fitgirl-repacks-sitefitgirlhttp://bit.ly/fitgirl-repacks-sitewelcome" - Source: "00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found URL "https://ru.riotpixels.com/games/fifa-21/openhttps://en.riotpixels.com/games/fifa-21/open-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exe" - Source: "00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x86.exe.execlick" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x86.exeselect" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "http://us.download.nvidia.com/windows/9.13.1220/physx-9.13.1220-systemsoftware.msidotnet35" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/0/e/20e90413-712f-438c-988e-fdaa79a8ac3d/dotnetfx35.exedotnet35cp" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/c/d/c/cdc0f321-4f72-4a08-9bac-082f3692ecd9/dotnetfx35client.exedotnet4full" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/5/a/95a9616b-7a37-4af6-bc36-d6ea96c8daae/dotnetfx40_full_x86_x64.exedotnet451" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/7/167f0d79-9317-48ae-aedb-17120579f8e2/ndp451-kb2858728-x86-x64-allos-enu.exedotnet471" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/4312fa21-59b0-4451-9482-a1376f7f3ba4/9947fce13c11105b48cba170494e787f/ndp471-kb4033342-x86-x64-allos-enu.exedotnet48" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/2d6bb6b2-226a-4baa-bdec-798822606ff1/9b7b8746971ed51a1770ae4293618187/ndp48-web.exevc_2005_sp1_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/8/b/4/8b42259f-5d70-43f4-ac2e-4b208fd8d66a/vcredist_x86.exevc_2008_sp1_x64" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/5/d/8/5d8c65cb-c849-4025-8e95-c3966cafd8ae/vcredist_x64.exevc_2008_sp1_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/5/d/8/5d8c65cb-c849-4025-8e95-c3966cafd8ae/vcredist_x86.exevc_2010_sp1_x64" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x64.exevc_2010_sp1_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/5/165255e7-1014-4d0a-b094-b6a430a6bffc/vcredist_x86.exevc_2012_x64" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x64.exevc_2012_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/1/6/b/16b06f60-3b20-4ff2-b699-5e9b7962f9ae/vsu_4/vcredist_x86.exevc_2013_x64" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/e/6/2e61cfa4-993b-4dd4-91da-3737cd5cd6e3/vcredist_x64.exevc_2013_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/2/e/6/2e61cfa4-993b-4dd4-91da-3737cd5cd6e3/vcredist_x86.exevc_2015_x64" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x64.exevc_2015_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.microsoft.com/download/9/3/f/93fcf1e7-e6a4-478b-96e7-d4b285925b00/vc_redist.x86.exevc_2017_x64" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/11100230/15ccb3f02745c7b206ad10373cbca89b/vc_redist.x64.exevc_2017_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/11100229/78c1e864d806e36f6035d80a0e80399e/vc_redist.x86.exevc_2019_x64" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/ee84fed2552e018e854d4cd2496df4dd516f30733a27901167b8a9882119e57c/vc_redist.x64.exevc_2019_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/9565895b-35a6-434b-a881-11a6f4beec76/4a8157b2ff422c259ddaa2d0e568c0c0afab940e1f6e0e482ef83e90ddbad2d6/vc_redist.x86.exevc_2022_x64" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://aka.ms/vs/17/release/vc_redist.x64.exevc_2022_x86" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://aka.ms/vs/17/release/vc_redist.x86.exebass.dllcls-lollypop.dllcls-lollypop_x64.execls-lollypop_x86.execls-srep_x64.execls-srep_x86.execls-magic2.dllcls-magic2_x64.execls-magic2_x86.execls-magic2l.dllcls-magic2l_x64.execls-magic2l_x86.exeflushfilecache.exearc.inicls.inicallbackctrl.dllbotva2.dllmusicbutton.pngmusic.mp3host.cmdhosts.exerz.exerzw.exerazor.dllrz-1.03.7-stdio.exe" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "http://bit.ly/fitgirl-repacks-siteopen/verysilent/suppressmsgboxescheck" - Source: "00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found URL "https://code.google.com/p/inno-download-plugin," - Source: "00000000-00002812.00000003.307440.10035000.00000002.mdmp") Found URL "http://mitrichsoftware.wordpress.comcompanynamemitrich" - Source: "00000000-00002812.00000003.307440.10035000.00000002.mdmp") Found URL "http://digibooster\\.\sysaudio__vbasetsystemerrormsvbvm60defaultdirectsoundcaptureenumeratewdirectsoundenumeratewdsound.sysbasspluginno" - Source: "00000000-00002812.00000003.307440.11001000.00000040.mdmp")44:T53d,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: ISDone.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: cls-magic2l_x64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: cls-magic2l_x86.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: cls-srep_x64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: idp.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: cls-srep_x86.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: cls-lollypop_x64.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: cls-lollypop_x86.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: innocallback.dll] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: botva2.dll]45:T12d5,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "setup.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "76610188899,7848,104,,GetKeyState,user32.dll,"01:17:36.031",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76653773439,7848,104,,GetKeyState,user32.dll,"01:17:36.046",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76653832137,7848,104,,GetKeyState,user32.dll,"01:17:36.046",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76622456608,7848,104,,GetKeyState,user32.dll,"01:17:36.031",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76634596618,7848,104,,GetKeyState,user32.dll,"01:17:36.031",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76666374506,7848,104,,GetKeyState,user32.dll,"01:17:36.046",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76653684003,7848,104,,GetKeyState,user32.dll,"01:17:36.046",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76653594519,7848,104,,GetKeyState,user32.dll,"01:17:36.046",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76634473824,7848,104,,GetKeyState,user32.dll,"01:17:36.031",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp") Found reference to API "150069354501,7848,104,,GetKeyState,user32.dll,"01:18:06.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "150093562514,7848,104,,GetKeyState,user32.dll,"01:18:06.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "150105424772,7848,104,,GetKeyState,user32.dll,"01:18:06.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "150081358856,7848,104,,GetKeyState,user32.dll,"01:18:06.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "150093436370,7848,104,,GetKeyState,user32.dll,"01:18:06.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "150105482386,7848,104,,GetKeyState,user32.dll,"01:18:06.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "146771577759,7848,104,,GetKeyState,user32.dll,"01:18:05.265",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "150118273586,7848,104,,GetKeyState,user32.dll,"01:18:06.656",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "150105619060,7848,104,,GetKeyState,user32.dll,"01:18:06.640",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000002.300089.02E30000.00000004.mdmp") Found reference to API "403062954629,7848,104,,GetKeyState,user32.dll,"01:19:52.046",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp")46:T573,file/memory contains long string with (Indicator: "aes"; File: "cls-magic2l_x64.exe") file/memory contains long string with (Indicator: "aes"; File: "cls-magic2l_x86.exe") file/memory contains long string with (Indicator: "aes"; File: "cls-srep_x64.exe") file/memory contains long string with (Indicator: "aes"; File: "cls-srep_x86.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "hosts.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "hosts.exe") Found string "WAesq61+" (Indicator: "aes"; Source: "00000000-00002812.00000001.298168.09F40000.00000004.mdmp, 00000000-00002812.00000002.300089.09F40000.00000004.mdmp, 00000000-00002812.00000003.307440.09F40000.00000004.mdmp") Found string "IPF_Base64InkSerializedFormatWWW" (Indicator: "base64"; Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp") Found string "IPF_Base64GIFWWWh" (Indicator: "base64"; Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp") Found string "Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi" (Indicator: "base64"; Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp") Found string "Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1" (Indicator: "base64"; Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp")47:T1518,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "setup.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "setup.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "setup.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "setup.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "setup.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "setup.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "setup.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.6B088000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.6B088000.00000004.mdmp, 00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00002812.00000001.298168.72631000.00000020.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002812.00000002.300089.6B088000.00000004.mdmp, 00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002812.00000003.307440.06509000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004208.00000001.298074.032A0000.00000004.mdmp, 00000000-00004208.00000002.299996.032A0000.00000004.mdmp, 00000000-00004208.00000003.307428.032A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004208.00000001.298074.032A0000.00000004.mdmp, 00000000-00004208.00000002.299996.032A0000.00000004.mdmp, 00000000-00004208.00000003.307428.032A0000.00000004.mdmp")48:T526,Found string "Where should FIFA 22 be installed?" (Indicator: "where "; Source: "00000000-00002812-00000455-35198330256") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found string "Where should FIFA 22 be installed?" (Indicator: "where "; Source: "00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00004208.00000003.307428.05430000.00000004.mdmp") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00004208.00000003.307428.05430000.00000004.mdmp")49:T633,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "setup.exe") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "setup.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "setup.exe") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002812.00000001.298168.72697000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004208.00000000.296154.00417000.00000004.mdmp")4a:T76d,Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found string "proxypassword" (Indicator: "password"; Source: "00000000-00002812.00000000.296248.1002A000.00000002.mdmp") Found string "password?" (Indicator: "password"; Source: "00000000-00002812.00000002.300089.06131000.00000020.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00004208.00000003.307428.05430000.00000004.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00004208.00000003.307428.05430000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00004208.00000003.307428.05430000.00000004.mdmp")4b:T53d,"Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 1125-1939-004D9DF8 "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 1125-6426-004CD790 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 1125-6575-004D4D84 "Software\Microsoft\Windows\CurrentVersion\Uninstall\FIFA 22_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002812.00000000.296248.09F40000.00000004.mdmp 00000000-00002812.00000001.298168.09F40000.00000004.mdmp 00000000-00002812.00000002.300089.09F40000.00000004.mdmp 00000000-00002812.00000003.307440.09F40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002812.00000003.307440.00401000.00000020.mdmp4c:T557,Found registry deletion API: "RegDeleteKeyExW" in file "00000000-00002812.00000003.307440.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in file "00000000-00002812.00000003.307440.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00002812.00000001.298168.72631000.00000020.mdmp, 00000000-00002812.00000003.307440.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00002812.00000001.298168.72631000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00002812.00000001.298168.72697000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExA" in "00000000-00002812.00000003.307440.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00002812.00000003.307440.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00002812.00000003.307440.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in "00000000-00002812.00000003.307440.00401000.00000020.mdmp"4d:T626,Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; File: "setup.exe") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp") Found reference to API "76594684035,7848,113,,SystemParametersInfoW,user32.dll,"01:17:36.015",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "76593743275,7848,113,,SystemParametersInfoW,user32.dll,"01:17:36.015",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00002812.00000001.298168.02E30000.00000004.mdmp") Found reference to API "403056713201,7848,113,,SystemParametersInfoW,user32.dll,"01:19:52.046",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "403055370493,7848,113,,SystemParametersInfoW,user32.dll,"01:19:52.046",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "403055311377,7848,113,,SystemParametersInfoW,user32.dll,"01:19:52.046",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00002812.00000003.307440.02E30000.00000004.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00002812.00000003.307440.06509000.00000004.mdmp")4e:T672,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp, 00000000-00002812.00000003.307440.00401000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002812.00000002.300089.0055D000.00000002.mdmp")4f:T1160,"razor.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\razor.dll]- [targetUID: 00000000-00002812] "ISDone.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\ISDone.dll]- [targetUID: 00000000-00002812] "cls-magic2l_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l_x64.exe]- [targetUID: 00000000-00002812] "cls-magic2l_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l_x86.exe]- [targetUID: 00000000-00002812] "cls-srep_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-srep_x64.exe]- [targetUID: 00000000-00002812] "idp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\idp.dll]- [targetUID: 00000000-00002812] "rz-1.03.7-stdio.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 9 sections"- Location: [%TEMP%\is-MBTN5.tmp\rz-1.03.7-stdio.exe]- [targetUID: 00000000-00002812] "rz.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 9 sections"- Location: [%TEMP%\is-MBTN5.tmp\rz.exe]- [targetUID: 00000000-00002812] "cls-srep_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 6 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-srep_x86.exe]- [targetUID: 00000000-00002812] "cls-lollypop_x64.exe" has type "PE32+ executable for MS Windows 4.00 (console) x86-64 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop_x64.exe]- [targetUID: 00000000-00002812] "cls-lollypop_x86.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop_x86.exe]- [targetUID: 00000000-00002812] "BASS.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-MBTN5.tmp\BASS.dll]- [targetUID: 00000000-00002812] "innocallback.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\innocallback.dll]- [targetUID: 00000000-00002812] "botva2.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\botva2.dll]- [targetUID: 00000000-00002812] "hosts.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\hosts.exe]- [targetUID: 00000000-00002812] "FlushFileCache.exe" has type "PE32 executable for MS Windows 5.00 (console) Intel i386 8 sections"- Location: [%TEMP%\is-MBTN5.tmp\FlushFileCache.exe]- [targetUID: 00000000-00002812] "cls-magic2l.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l.dll]- [targetUID: 00000000-00002812] "cls-lollypop.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop.dll]- [targetUID: 00000000-00002812] "wintb.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%TEMP%\is-MBTN5.tmp\wintb.dll]- [targetUID: 00000000-00002812] "rzw.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\rzw.exe]- [targetUID: 00000000-00002812] "CallbackCtrl.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\CallbackCtrl.dll]- [targetUID: 00000000-00002812] "setup.tmp" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-BAMKF.tmp\setup.tmp]- [targetUID: 00000000-00004208] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002812] "cls-magic2_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2_x64.exe]- [targetUID: 00000000-00002812] "cls-magic2_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2_x86.exe]- [targetUID: 00000000-00002812]50:T83d,Found string "GetLongPathNameW" (Source: setup.exe, API is part of module: KERNELBASE.DLL) Found string "VarNeg" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromDate" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromBool" (Source: setup.exe, API is part of module: OLEAUT32.DLL) Found string "SetDllDirectoryW" (Source: setup.exe, API is part of module: KERNEL32.DLL) Found string "SetSearchPathMode" (Source: setup.exe, API is part of module: KERNEL32.DLL) Found string "SetProcessDEPPolicy" (Source: setup.exe, API is part of module: KERNEL32.DLL)51:T120d,"razor.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\razor.dll]- [targetUID: 00000000-00002812] "ISDone.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\ISDone.dll]- [targetUID: 00000000-00002812] "cls-magic2l_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l_x64.exe]- [targetUID: 00000000-00002812] "cls-magic2l_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l_x86.exe]- [targetUID: 00000000-00002812] "cls-srep_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-srep_x64.exe]- [targetUID: 00000000-00002812] "idp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\idp.dll]- [targetUID: 00000000-00002812] "rz-1.03.7-stdio.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 9 sections"- Location: [%TEMP%\is-MBTN5.tmp\rz-1.03.7-stdio.exe]- [targetUID: 00000000-00002812] "rz.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 9 sections"- Location: [%TEMP%\is-MBTN5.tmp\rz.exe]- [targetUID: 00000000-00002812] "cls-srep_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 6 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-srep_x86.exe]- [targetUID: 00000000-00002812] "cls-lollypop_x64.exe" has type "PE32+ executable for MS Windows 4.00 (console) x86-64 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop_x64.exe]- [targetUID: 00000000-00002812] "cls-lollypop_x86.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop_x86.exe]- [targetUID: 00000000-00002812] "BASS.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-MBTN5.tmp\BASS.dll]- [targetUID: 00000000-00002812] "innocallback.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\innocallback.dll]- [targetUID: 00000000-00002812] "botva2.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%TEMP%\is-MBTN5.tmp\botva2.dll]- [targetUID: 00000000-00002812] "hosts.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\hosts.exe]- [targetUID: 00000000-00002812] "FlushFileCache.exe" has type "PE32 executable for MS Windows 5.00 (console) Intel i386 8 sections"- Location: [%TEMP%\is-MBTN5.tmp\FlushFileCache.exe]- [targetUID: 00000000-00002812] "cls-magic2l.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2l.dll]- [targetUID: 00000000-00002812] "cls-lollypop.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-lollypop.dll]- [targetUID: 00000000-00002812] "wintb.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%TEMP%\is-MBTN5.tmp\wintb.dll]- [targetUID: 00000000-00002812] "rzw.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\rzw.exe]- [targetUID: 00000000-00002812] "CallbackCtrl.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\CallbackCtrl.dll]- [targetUID: 00000000-00002812] "setup.tmp" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-BAMKF.tmp\setup.tmp]- [targetUID: 00000000-00004208] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-MBTN5.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002812] "cls-magic2_x64.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2_x64.exe]- [targetUID: 00000000-00002812] "cls-magic2_x86.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 2 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2_x86.exe]- [targetUID: 00000000-00002812] "cls-magic2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-MBTN5.tmp\cls-magic2.dll]- [targetUID: 00000000-00002812]52:T1463,"setup.exe" wrote 51712 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BAMKF.tmp\setup.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "setup.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup.tmp" wrote 23312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\_isetup\_shfoldr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup.tmp" wrote 65024 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\innocallback.dll": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "setup.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\wintb.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\cls-lollypop.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\cls-magic2.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\cls-magic2l.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup.tmp" wrote 29696 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\FlushFileCache.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "setup.tmp" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\CallbackCtrl.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup.tmp" wrote 37888 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\botva2.dll": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "setup.tmp" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\hosts.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup.tmp" wrote 11264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MBTN5.tmp\rzw.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...53:T4bd,RegCloseKey OpenProcessToken RegOpenKeyExW GetFileSize LoadLibraryW GetTickCount Sleep LoadLibraryExW DeleteFileW GetCommandLineW CreateFileW GetModuleFileNameW UnhandledExceptionFilter GetFileAttributesW FindResourceW VirtualAlloc WriteFile GetProcAddress CreateProcessW FindFirstFileW GetVersionExW GetModuleHandleW LockResource GetStartupInfoA VirtualProtect GetSystemInfo CreateDirectoryW LoadLibraryA RegOpenKeyExA ReadProcessMemory ExitThread FindNextFileA TerminateProcess GetFileAttributesA OpenProcess CreateFileA CreateDirectoryA CreateProcessA GetModuleHandleA DeleteFileA GetModuleFileNameA GetCommandLineA CreateThread FindFirstFileA NtQueryInformationFile GetCursorPos GetModuleHandleExW FindFirstFileExA MapViewOfFile GetStartupInfoW GetModuleHandleExA CreateFileMappingA LoadLibraryExA IsDebuggerPresent OpenFileMappingA OutputDebugStringW GetVersionExA FtpGetFileSize InternetOpenW InternetReadFile HttpQueryInfoW InternetCrackUrlW HttpSendRequestW InternetConnectW InternetQueryOptionW FtpOpenFileW InternetCloseHandle FindNextFileW OutputDebugStringA GetTempFileNameW GetTempPathW GetThreadContext GetWindowThreadProcessId54:T5d9,Antivirus vendors marked dropped file "razor.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 3 sections"), Antivirus vendors marked dropped file "ISDone.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "cls-srep_x64.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"), Antivirus vendors marked dropped file "rz-1.03.7-stdio.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 9 sections"), Antivirus vendors marked dropped file "rz.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 (stripped to external PDB) 9 sections"), Antivirus vendors marked dropped file "cls-srep_x86.exe" as clean (type is "PE32 executable for MS Windows 5.01 (console) Intel i386 6 sections"), Antivirus vendors marked dropped file "innocallback.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "botva2.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "hosts.exe" as clean (type is "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "wintb.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections")55:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790292124804,"unified_at":"2026-09-24T23:22:04.804Z","metadata":{"hashes":{"sha256":"962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","sha1":"7c1028d6d0b340ea17bb4392a519348aa80571e4","md5":"08f864adb53dfde5f7b8ade6a8dabb42","sha512":"c74f539713dc3bc1479ae11e658552f25603f9cef01f43e780961490192e6e2468e31280df37ecf11b37e7fd12c205e27c9b2203008ee9d09d13cb1a90f0c268","ssdeep":"49152:vm0cAfn7wh0QIaUrjJcIAVUbUVPH12JxQHh3PW6BsVyYuYDPb6FLm308g+R2v:/f7wCQInrje/CAVMJy1WGsF3iha0NN","ssdeep_chunks":["49152:vm0cAfn","49152:m0cAfn7","49152:0cAfn7w","49152:cAfn7wh","49152:Afn7wh0","49152:fn7wh0Q","49152:n7wh0QI","49152:7wh0QIa","49152:wh0QIaU","49152:h0QIaUr","49152:0QIaUrj","49152:QIaUrjJ","49152:IaUrjJc","49152:aUrjJcI","49152:UrjJcIA","49152:rjJcIAV","49152:jJcIAVU","49152:JcIAVUb","49152:cIAVUbU","49152:IAVUbUV","49152:AVUbUVP","49152:VUbUVPH","49152:UbUVPH1","49152:bUVPH12","49152:UVPH12J","49152:VPH12Jx","49152:PH12JxQ","49152:H12JxQH","49152:12JxQHh","49152:2JxQHh3","49152:JxQHh3P","49152:xQHh3PW","49152:QHh3PW6","49152:Hh3PW6B","49152:h3PW6Bs","49152:3PW6BsV","49152:PW6BsVy","49152:W6BsVyY","49152:6BsVyYu","49152:BsVyYuY","49152:sVyYuYD","49152:VyYuYDP","49152:yYuYDPb","49152:YuYDPb6","49152:uYDPb6F","49152:YDPb6FL","49152:DPb6FLm","49152:Pb6FLm3","49152:b6FLm30","49152:6FLm308","49152:FLm308g","49152:Lm308g+","49152:m308g+R","49152:308g+R2","49152:08g+R2v","98304:vm0cAfn","98304:m0cAfn7","98304:0cAfn7w","98304:cAfn7wh","98304:Afn7wh0","98304:fn7wh0Q","98304:n7wh0QI","98304:7wh0QIa","98304:wh0QIaU","98304:h0QIaUr","98304:0QIaUrj","98304:QIaUrjJ","98304:IaUrjJc","98304:aUrjJcI","98304:UrjJcIA","98304:rjJcIAV","98304:jJcIAVU","98304:JcIAVUb","98304:cIAVUbU","98304:IAVUbUV","98304:AVUbUVP","98304:VUbUVPH","98304:UbUVPH1","98304:bUVPH12","98304:UVPH12J","98304:VPH12Jx","98304:PH12JxQ","98304:H12JxQH","98304:12JxQHh","98304:2JxQHh3","98304:JxQHh3P","98304:xQHh3PW","98304:QHh3PW6","98304:Hh3PW6B","98304:h3PW6Bs","98304:3PW6BsV","98304:PW6BsVy","98304:W6BsVyY","98304:6BsVyYu","98304:BsVyYuY","98304:sVyYuYD","98304:VyYuYDP","98304:yYuYDPb","98304:YuYDPb6","98304:uYDPb6F","98304:YDPb6FL","98304:DPb6FLm","98304:Pb6FLm3","98304:b6FLm30","98304:6FLm308","98304:FLm308g","98304:Lm308g+","98304:m308g+R","98304:308g+R2","98304:08g+R2v","49152:/f7wCQI","49152:f7wCQIn","49152:7wCQInr","49152:wCQInrj","49152:CQInrje","49152:QInrje/","49152:Inrje/C","49152:nrje/CA","49152:rje/CAV","49152:je/CAVM","49152:e/CAVMJ","49152:/CAVMJy","49152:CAVMJy1","49152:AVMJy1W","49152:VMJy1WG","49152:MJy1WGs","49152:Jy1WGsF","49152:y1WGsF3","49152:1WGsF3i","49152:WGsF3ih","49152:GsF3iha","49152:sF3iha0","49152:F3iha0N","49152:3iha0NN"],"imphash":"483f0c4259a9148c34961abbda6146c1","pehash":"b88e8a6a504292cee2a40701c4b82778030ccd9e"},"file_info":{"file_name":"setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4260129,"entropy":8,"compile_timestamp":"2012-10-02T05:04:04","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1767299350000,"last_seen":1788517586000,"last_multi_scan":1788517586000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":82936,"raw_size":82944},{"name":".itext","virtual_address":"0x16000","virtual_size":3048,"raw_size":3072},{"name":".data","virtual_address":"0x17000","virtual_size":3484,"raw_size":3584},{"name":".bss","virtual_address":"0x18000","virtual_size":22352},{"name":".idata","virtual_address":"0x1e000","virtual_size":3998,"raw_size":4096},{"name":".tls","virtual_address":"0x1f000","virtual_size":8},{"name":".rdata","virtual_address":"0x20000","virtual_size":24,"raw_size":512},{"name":".rsrc","virtual_address":"0x21000","virtual_size":45568,"raw_size":45568}],"section_names":[".text",".itext",".data",".bss",".idata",".tls",".rdata",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["installcore","sabsik","downloadassistant","stealer","kryptik","pup","bit","pua","conduit"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":76},"sandbox_signatures":{"informative_count":228,"suspicious_count":21,"malicious_count":2,"total":251},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Able to access Cisco VPN profile file"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"suspicious","value":"Contains ability to modify thread functionality - possible hijack (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"Uses bzip2 compression library to compress data"},{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","identifiers":[{"type":"suspicious","value":"Drops image files with high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Borland\\Delphi\\RTL\" in Source: sample.bin, \"Software\\Borland\\Locales\" in Source: sample.bin, \"Software\\Borland\\Delphi\\Locales\" in Source: sample.bin, \"Software\\CodeGear\\Locales\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \":x.mx\", Pattern match: \"http://schemas.microsoft.com/smi/2\", Heuristic match: \"pr.pa\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$26","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"hosts.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"setup.exe\" called \"FindResourceW\" with parameter \"11111\" - (UID: 00000000-00004208)\n \"setup.tmp\" called \"FindResourceW\" with parameter \"81153044\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"FindResourceW\" with parameter \"5135764\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"FindResourceW\" with parameter \"81037836\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"FindResourceW\" with parameter \"167327804\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"FindResourceW\" with parameter \"81155116\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"FindResourceW\" with parameter \"81037932\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"FindResourceW\" with parameter \"81006196\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"FindResourceW\" with parameter \"81005636\" - (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"setup.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4330384'}\" (UID: 00000000-00004208)\n \"setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5630456'}\" (UID: 00000000-00002812)\n \"setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5630488'}\" (UID: 00000000-00002812)\n \"setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5630552'}\" (UID: 00000000-00002812)\n \"setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5630504'}\" (UID: 00000000-00002812)\n \"setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5630600'}\" (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.0055D000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002812.00000002.300089.0055D000.00000002.mdmp\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"hosts.exe\")\n file/memory contains long string with (Indicator: \"MD5CryptoServiceProvider\"; File: \"hosts.exe\")\n Found reference to \"WAesq61+\" (Indicator: \"Aes\"; Source: \"00000000-00002812.00000001.298168.09F40000.00000004.mdmp, 00000000-00002812.00000002.300089.09F40000.00000004.mdmp, 00000000-00002812.00000003.307440.09F40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002812.00000002.300089.0055D000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\sysaudio; Source: \"00000000-00002812.00000003.307440.11001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"setup.exe\" queried SystemProcessInformation at 00000000-00004208-00000C15-3629599340 [PID: 4208]\n \"setup.exe\" queried SystemProcessInformation at 00000000-00004208-00000C15-3629608771 [PID: 4208]\n \"setup.tmp\" queried SystemProcessInformation at 00000000-00002812-00000C15-3630846345 [PID: 2812]\n \"setup.tmp\" queried SystemProcessInformation at 00000000-00002812-00000C15-3630855904 [PID: 2812]\n \"setup.tmp\" queried SystemProcessInformation at 00000000-00002812-00000C15-3631606255 [PID: 2812]\n \"setup.tmp\" queried SystemProcessInformation at 00000000-00002812-00000C15-3631614834 [PID: 2812]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"setup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"setup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \"UPX0\" is zero\n Raw size of \"BSS\" is zero\n Raw size of \"\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"hosts.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.98397","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform crypto operations\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$27","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"setup.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"hosts.exe\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp\")\n Found string \"function GetUserNameString: String;\" (Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00004208.00000003.307428.05430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"setup.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"_setup64.tmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002812-00000C2C-3631285011\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002812.00000002.300089.0055D000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002812.00000002.300089.0055D000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"setup.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"setup.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004208)\n \"setup.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004208)\n \"setup.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002812)\n \"setup.tmp\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00002812)\n \"setup.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002812)\n \"setup.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"setup.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004208)\n \"setup.tmp\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"setup.tmp\" called \"IsWow64Process\" with parameter \"2812\" - (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"setup.tmp\" called \"EnumWindows\" with parameter \"11531480\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"EnumWindows\" with parameter \"11532024\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"EnumWindows\" with parameter \"11528560\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"EnumWindows\" with parameter \"11528296\" - (UID: 00000000-00002812)\n \"setup.tmp\" called \"EnumWindows\" with parameter \"11531872\" - (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2a","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"setup.tmp\" called \"GetActiveWindow\" (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004208)\n \"setup.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"setup.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004208)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: setup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: cls-lollypop_x64.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: cls-lollypop_x86.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: FlushFileCache.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@kernel32.dll at 63803-1878-004011D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"cls-magic2l.dll\")\n file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"cls-lollypop.dll\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"hosts.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_OSVersion\" in \"hosts.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@kernel32.dll at 63803-1475-004069A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@kernel32.dll at 63803-1165-00406A64\n GetVersion@kernel32.dll at 63803-1173-004011C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@kernel32.dll at 63803-1135-004069B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@kernel32.dll at 63803-1459-00406970","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"setup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"setup.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@kernel32.dll at 63803-1183-004011D8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver Ver\" (Indicator: \"ver \") in Source: 00000000-00002812.00000001.298168.72631000.00000020.mdmp\n Observed string: \"Ver VerH&crT\" (Indicator: \"ver \") in Source: 00000000-00002812.00000001.298168.72631000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardType@user32.dll at 63803-1181-004036FC\n GetUserDefaultLangID@kernel32.dll at 63803-1566-00406A5C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\IS-MBTN5.TMP\\BOTVA2.DLL\n %TEMP%\\IS-MBTN5.TMP\\BASS.DLL\n %TEMP%\\IS-MBTN5.TMP\\WINTB.DLL\n %TEMP%\\IS-MBTN5.TMP\\INNOCALLBACK.DLL\n %TEMP%\\IS-MBTN5.TMP\\IDP.DLL\n %TEMP%\\IS-MBTN5.TMP\\ISDONE.DLL\n %TEMP%\\IS-MBTN5.TMP\\CALLBACKCTRL.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"setup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"setup.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"setup.tmp\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\MusicButton.png\" at 00000000-00002812-00000C17-3638206159","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"setup.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\FIFA 22_IS1\")\n \"setup.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\FIFA 22_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"hosts.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"hosts.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002812.00000002.300089.0055D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"setup.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"setup.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"setup.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\is-BAMKF.tmp (UID: 00000000-00004208)\n \"setup.tmp\" called \"CreateDirectoryW\" with parameter %TEMP%\\is-MBTN5.tmp (UID: 00000000-00002812)\n \"setup.tmp\" called \"CreateDirectoryW\" with parameter %TEMP%\\is-MBTN5.tmp\\_isetup (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"setup.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-BAMKF.tmp\\setup.tmp\" /SL5=\"$401CA\n3663806\n140800\nC:\\setup.exe\"\" - (UID: 00000000-00004208)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"hosts.exe\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@kernel32.dll at 63803-1405-0040121C\n Sleep@kernel32.dll at 63803-1563-0040DC2C\n MsgWaitForMultipleObjects at 63803-1666-00406B6C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: razor.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: ISDone.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: cls-magic2l_x64.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: cls-magic2l_x86.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: cls-srep_x64.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: idp.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: cls-srep_x86.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: botva2.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: FlushFileCache.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@kernel32.dll at 63803-1495-00406A84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx\" (Indicator: \"ShellExecute\"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx returned hProcess=0\" (Indicator: \"ShellExecute\"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx returned hProcess=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"setup.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"setup.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"setup.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004208.00000000.296154.00417000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"setup.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"setup.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.6B088000.00000004.mdmp, 00000000-00002812.00000003.307440.06509000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp, 00000000-00002812.00000002.300089.6B088000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"hosts.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$34","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: ISDone.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"setup.exe\" with parameter %TEMP%\\is-BAMKF.tmp (UID: 00000000-00004208)\n \"setup.tmp\" with parameter %TEMP%\\is-MBTN5.tmp (UID: 00000000-00002812)\n \"setup.tmp\" with parameter %TEMP%\\is-MBTN5.tmp\\_isetup (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process setup.tmp created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2812:168:WilStaging_02\"\n Process setup.tmp created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n Process setup.tmp created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n Process setup.tmp created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:2812:64:WilError_01\"\n Process setup.tmp created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\DirectSound DllMain mutex (0x00000AFC)\"\n Process setup.tmp created mutex with name \"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n Process setup.tmp created mutex with name \"SM0:2812:64:WilError_01\"\n Process setup.tmp created mutex with name \"DirectSound DllMain mutex (0x00000AFC)\"\n Process setup.tmp created mutex with name \"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n Process setup.tmp created mutex with name \"Local\\SM0:2812:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"hosts.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"cls-magic2l.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"cls-lollypop.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"rdata@.data.rsrc\"\n Pattern match: \"ijya@i99d3.zinw\"\n Pattern match: \"christian.martelock@web.de\"\n Pattern match: \"her@ier0.dr\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"AssocQueryString\" in \"hosts.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77850000\n \"setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73650000\n \"setup.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77850000\n \"setup.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73650000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77790000\n \"setup.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77790000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$37","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"setup.tmp\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"setup.tmp\" touched \"Microsoft Multiple AutoComplete List Container\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2765-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")\n \"setup.tmp\" touched \"Microsoft Shell Folder AutoComplete List\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{03C036F1-A186-11D0-824A-00AA005B4383}\\TREATAS\")\n \"setup.tmp\" touched \"Microsoft AutoComplete\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2763-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")\n \"setup.tmp\" touched \"Microsoft TipAutoCompleteClient Control\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\\TREATAS\")\n \"setup.tmp\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")\n \"setup.tmp\" touched \"MMDeviceEnumerator class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{BCDE0395-E52F-467C-8E3D-C4579291692E}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"hosts.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"cls-magic2l_x64.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"cls-magic2l_x86.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"idp.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"cls-lollypop_x64.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"cls-lollypop_x86.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"cls-magic2l.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$38","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$39","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3a","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x162000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"cls-magic2l_x64.exe\" has high imagebase \"0x140000000\"\n \"cls-srep_x64.exe\" has high imagebase \"0x140000000\"\n \"cls-lollypop_x64.exe\" has high imagebase \"0x140000000\"\n \"wintb.dll\" has high imagebase \"0x6b080000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"setup.tmp\" (UID: 00000000-00002812) was launched with new environment variables: \"__PROCESS_HISTORY=\"C:\\setup.exe\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"setup.tmp\" (UID: 00000000-00002812) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"RU-RU\")\n \"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"RU-RU\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\shlwapi.dll\" [Source: 00000000-00002812-00000C2B-3636842438]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"setup.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"setup.tmp\" with commandline \"/SL5=\"$401CA\n3663806\n140800\nC:\\\\setup.exe\"\" (UID: 00000000-00002812)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"setup.tmp\" with commandline \"/SL5=\"$401CA\n3663806\n140800\nC:\\\\setup.exe\"\" (UID: 00000000-00002812)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$3b","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-BAMKF.tmp\\setup.tmp\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\_isetup\\_setup64.tmp\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\_isetup\\_shfoldr.dll\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\idp.dll\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\innocallback.dll\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\ISDone.dll\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\wintb.dll\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\BASS.dll\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\cls-lollypop.dll\"\n \"setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-MBTN5.tmp\\cls-lollypop_x64.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"setup.tmp\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3c","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"setup.tmp\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\" - Location: [%TEMP%\\is-BAMKF.tmp\\setup.tmp]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\" - Location: [%TEMP%\\is-MBTN5.tmp\\_isetup\\_setup64.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$3e","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"setup.exe\" queries basic process information of the \"C:\\setup.exe\" (UID: 4208)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"setup.exe\" reads file \"c:\\setup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00002812.00000002.300089.0055D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to perform sandbox evasion using APIs\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to query volume size\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"setup.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"setup.exe\" trying to touch file \"C:\\setup.exe\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcGenral.dll\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\uxtheme.dll\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winmm.dll\"\n \"setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\samcli.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-bamkf.tmp\\setup.tmp\"\n \"setup.exe\" writes file \"%temp%\\is-bamkf.tmp\\setup.tmp\"\n \"setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-mbtn5.tmp\\_isetup\\_setup64.tmp\"\n \"setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-mbtn5.tmp\\_isetup\\_shfoldr.dll\"\n \"setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-mbtn5.tmp\\idp.dll\"\n \"setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-mbtn5.tmp\\innocallback.dll\"\n \"setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-mbtn5.tmp\\isdone.dll\"\n \"setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-mbtn5.tmp\\wintb.dll\"\n \"setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-mbtn5.tmp\\bass.dll\"\n \"setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-mbtn5.tmp\\cls-lollypop.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"setup.exe\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000003.307440.11001000.00000040.mdmp\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002812.00000003.307440.11001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"setup.exe\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002812.00000000.296248.1002A000.00000002.mdmp, 00000000-00002812.00000003.307440.11001000.00000040.mdmp\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002812.00000003.307440.11001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"rzw.exe\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"setup.exe\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"setup.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002812.00000000.296248.1002A000.00000002.mdmp\")\n Found reference to API \"InternetReadFileExA\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002812.00000003.307440.11001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"hosts.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"setup.exe\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002812.00000000.296248.1002A000.00000002.mdmp\")\n Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002812.00000003.307440.11001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"setup.exe\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00002812.00000000.296248.1002A000.00000002.mdmp\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00002812.00000003.307440.11001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"setup.exe\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002812.00000000.296248.1002A000.00000002.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002812.00000003.307440.11001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"User chose not to shutdown applications using our files.\" (Indicator: \" shutdown \"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"User chose not to shutdown applications using our files.\" (Indicator: \" shutdown \"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Contains references to the retrieval of internet session handle (imports API)","description":"Found InternetQueryOptionW in import section (Source: idp.dll)","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-206","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"{tmp}\\cls-lollypop.dll\" [Source: 00000000-00002812.00000000.296248.04C40000.00000004.mdmp\n 00000000-00002812.00000001.298168.04C40000.00000004.mdmp\n 00000000-00002812.00000002.300089.04C40000.00000004.mdmp\n 00000000-00002812.00000003.307440.04C40000.00000004.mdmp]\n Observed email domain:\"cls-lollypop.dll\" [Source: 00000000-00002812.00000000.296248.04C40000.00000004.mdmp\n 00000000-00002812.00000000.296248.09F40000.00000004.mdmp\n 00000000-00002812.00000001.298168.04C40000.00000004.mdmp\n 00000000-00002812.00000001.298168.09F40000.00000004.mdmp\n 00000000-00002812.00000002.300089.04C40000.00000004.mdmp\n 00000000-00002812.00000002.300089.09F40000.00000004.mdmp\n 00000000-00002812.00000003.307440.04C40000.00000004.mdmp\n 00000000-00002812.00000003.307440.09F40000.00000004.mdmp]\n Observed email domain:\"cls-lollypop.dll\" [Source: 00000000-00004208.00000003.307428.05430000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.9.7.151\"\n \"1.0.0.0\"\n \"0.6.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"cls-srep_x86.exe\"\n YARA signature for AES encryption matched on file \"ISDone.dll\"\n YARA signature for AES encryption matched on file \"cls-srep_x64.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"setup.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"ISDone.dll\"\n YARA signature matched on embedded PE in file \"setup.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Cisco VPN profile file","description":"file/memory contains long string with (Indicator: \".pcf\"; File: \"ISDone.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-866","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$44","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"setup.tmp\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"setup.tmp\" called \"FindFirstFileW\" with parameter %TEMP%\\is-BAMKF.tmp\\setup.tmp (UID: 00000000-00002812)\n \"setup.tmp\" called \"FindFirstFileW\" with parameter %TEMP%\\is-MBTN5.tmp\\music.mp3 (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"setup.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"setup.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: ISDone.dll)\n Found GetCursorPos() in an import section (Source: botva2.dll)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004208.00000003.307428.05430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002812.00000000.296248.04C40000.00000004.mdmp, 00000000-00002812.00000001.298168.04C40000.00000004.mdmp, 00000000-00002812.00000002.300089.04C40000.00000004.mdmp, 00000000-00002812.00000003.307440.04C40000.00000004.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004208.00000003.307428.05430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00002812.00000001.298168.72631000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameString\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002812.00000000.296248.04C40000.00000004.mdmp\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002812.00000001.298168.72631000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"setup.tmp\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"setup.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"cls-lollypop_x64.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"cls-lollypop_x86.exe\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"FlushFileCache.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"setup.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004208.00000000.296154.00417000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: setup.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ISDone.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: cls-lollypop_x64.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: cls-lollypop_x86.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: FlushFileCache.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002812.00000000.296248.02E30000.00000004.mdmp, 00000000-00002812.00000001.298168.02E30000.00000004.mdmp, 00000000-00002812.00000002.300089.02E30000.00000004.mdmp, 00000000-00002812.00000003.307440.02E30000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004208.00000001.298074.032A0000.00000004.mdmp, 00000000-00004208.00000002.299996.032A0000.00000004.mdmp, 00000000-00004208.00000003.307428.032A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002812.00000000.296248.00555000.00000004.mdmp, 00000000-00002812.00000001.298168.72697000.00000002.mdmp, 00000000-00002812.00000002.300089.00555000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"setup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\TEMP\\IS-BAMKF.TMP\\SETUP.TMP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"setup.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"OWNER\"; Value: \"FC0A00008F534B67A07BDC0100\")\n \"setup.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"SESSIONHASH\"; Value: \"@W;\")\n \"setup.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"SEQUENCE\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002812.00000001.298168.72697000.00000002.mdmp\")\n Found reference to API \"procedure CreateMutex(const Name: String);\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002812.00000003.307440.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$4f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"MusicButton.png\" has type \"PNG image data 36 x 288 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"ISDone.dll\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Mon Feb 15 03:05:54 2010\n \"innocallback.dll\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"botva2.dll\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Sat Nov 29 03:30:19 1997","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"setup.exe\" was detected as \"Borland Delphi 4.0\"\n \"ISDone.dll\" was detected as \"Borland Delphi 4.0\"\n \"cls-magic2l_x86.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"cls-srep_x86.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"BASS.dll\" was detected as \"Petite v1.4\"\n \"innocallback.dll\" was detected as \"Borland Delphi DLL\"\n \"botva2.dll\" was detected as \"Borland Delphi 4.0\"\n \"hosts.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"FlushFileCache.exe\" was detected as \"Borland Delphi 4.0\"\n \"rzw.exe\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"setup.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"setup.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"setup.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"setup.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002812.00000000.296248.00AEE000.00000004.mdmp, 00000000-00002812.00000000.296248.0618C000.00000004.mdmp, 00000000-00002812.00000000.296248.1002A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"setup.tmp\" at 00000000-00002812-00000C15-3637310941","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"razor.dll\" has a section named \"UPX0\"\n \"razor.dll\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"razor.dll\" has section name UPX1 with entropy \"7.8921171571525335\"\n \"BASS.dll\" has section name with entropy \"7.981971620679563\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\is-MBTN5.tmp\\razor.dll\" has high entropy 7.88354\n Dropped file \"%TEMP%\\is-MBTN5.tmp\\BASS.dll\" has high entropy 7.94408\n Dropped file \"%TEMP%\\is-MBTN5.tmp\\music.mp3\" has high entropy 7.98166\n Dropped file \"%TEMP%\\is-MBTN5.tmp\\MusicButton.png\" has high entropy 7.65236","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops image files with high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\is-MBTN5.tmp\\MusicButton.png\" has high entropy 7.65236","origin":"Binary File","mitre_attack_id":"T1001.002","relevance":5,"id":"binary-61","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses bzip2 compression library to compress data","description":"Found CRC table used in bzip2 compression \"00000000-00002812.00000003.307440.11001000.00000040.mdmp\" at offset 165892; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d","origin":"Memory Dumps","mitre_attack_id":"T1560.002","relevance":3,"id":"memorydump-20","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"setup.tmp\" called \"FileTimeToLocalFileTime\" with parameter 52f2d567a07bdc01 & 52b2b2595d7bdc01 (UID: 00000000-00002812)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@kernel32.dll at 63803-1157-0040DC58\n GetModuleHandleW@kernel32.dll at 63803-1162-004069C0\n GetModuleHandleW@kernel32.dll at 63803-1523-0040ECE8\n GetModuleHandleW@kernel32.dll at 63803-1587-00411C50\n GetModuleHandleW@kernel32.dll at 63803-1674-00416254","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@kernel32.dll at 63803-1176-00401140","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@user32.dll at 63803-1154-00406B54","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryW@kernel32.dll at 63803-1560-00411440\n CreateDirectoryW@kernel32.dll at 63803-1561-004068D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$51","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$52","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid code section of PE file \"cls-lollypop.dll\"\n YARA signature for invalid Base of code of PE file \"cls-lollypop.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file cls.extensions within a single string in file \"rz-1.03.7-stdio.exe\" : .ogg\n .tif\n .php\n .sxw\n .db\n .wpd\n .sti\n .dat\n .xlw\n .stc\n .pak\n .fla\n .hpp\n .ppt\n .cpi\n .rar\n .sxi\n .jar\n .aspx\n .obj\n .jpe\n .max\n .tiff\n .eps\n .cgm\n .pdf\n .dot\n .pas\n .md\n .m4a\n .bz2\n .bmp\n .wma\n .tar\n .rb\n .asm\n .pps\n .doc\n .nvram\n .jpg\n .dwg\n .odf\n .wmv\n .html\n .dbf\n .jpeg\n .otp\n .zip\n .fdb\n .xlr\n .bin\n .vbs\n .docx\n .odg\n .otg\n .mdf\n .ai\n .tgz\n .stm\n .js\n .py\n .3gp\n .mp3\n .mpeg\n .pl\n .avi\n .flac\n .nsf\n .css\n .tex\n .crt\n .wav\n .vhd\n .bat\n .psd\n .asp\n .ots\n .arc\n .mp4\n .3ds\n .sql\n .sxc\n .vb\n .cmd\n .aac\n .dxf\n .txt\n .cpp\n .7z\n .odp\n .srt\n .xls\n .awg\n .gdb\n .vmdk\n .swf\n .ps\n .xlt\n .vmsd\n .rm\n .cs\n .asc\n .pdb\n .wps\n .class\n .frm\n .cls\n .mov\n .png\n .gif\n .mdb\n .stw\n .sxd\n .sh\n .sxg\n .rtf\n .ott\n .gz\n .xml\n .mpg\n .key\n .odt\n .svg\n .ods\n .java","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@kernel32.dll at 63803-1807-0041695E\n RemoveDirectoryW@kernel32.dll at 63803-1809-00406AAC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueW@advapi32.dll at 63803-1946-00406895","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"idp.dll\" claimed CRC 270703 while the actual is CRC 295506\n \"rz-1.03.7-stdio.exe\" claimed CRC 212360 while the actual is CRC 270703\n \"rz.exe\" claimed CRC 230925 while the actual is CRC 254952\n \"wintb.dll\" claimed CRC 69401 while the actual is CRC 22039","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"razor.dll\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$53","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"setup.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-BAMKF.tmp\\setup.tmp\" (Handle: 724)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@user32.dll at 63803-2212-00406B4A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"setup.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"setup.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"setup.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00008196.00000000.195652.0018E000.00000004.mdmp, 00000000-00008196.00000000.195652.02F6C000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00008196.00000000.195652.0018E000.00000004.mdmp, 00000000-00008196.00000000.195652.02F6C000.00000004.mdmp, 00000000-00008196.00000003.206865.1002A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$54","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"setup.tmp\" with commandline \"/SL5=\"$D03D8\n3663806\n140800\nC:\\\\setup.exe\"\" (UID: 00000000-00008196)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"setup.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]}],"intel_graph":{"map":{"File:00bde9e1e69822f9d9616889297e62f17ee9735c9c0b20328374230df61579bc":{"type":"File","value":"00bde9e1e69822f9d9616889297e62f17ee9735c9c0b20328374230df61579bc","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449":{"type":"File","value":"09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449"},"File:1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435":{"type":"File","value":"1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435"},"File:2d32c4f4522bc62f63c7949313434f6ca0eaa6b65b44ee5aa8b6b877988b1aa8":{"type":"File","value":"2d32c4f4522bc62f63c7949313434f6ca0eaa6b65b44ee5aa8b6b877988b1aa8"},"File:4004ba624f8ce381c61c82aba26e246d93e833357930c17cd4b02058ea31fad4":{"type":"File","value":"4004ba624f8ce381c61c82aba26e246d93e833357930c17cd4b02058ea31fad4"},"File:4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855":{"type":"File","value":"4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855"},"File:450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105":{"type":"File","value":"450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105"},"File:49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119":{"type":"File","value":"49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119"},"File:4a4c7c3705b493944367d390a2256ba1f65a358a2411580fac28075caf934a0d":{"type":"File","value":"4a4c7c3705b493944367d390a2256ba1f65a358a2411580fac28075caf934a0d"},"File:4b95254cc61623c23db4240367cc144fc729c83e5b222be2cfe563b32f7a089c":{"type":"File","value":"4b95254cc61623c23db4240367cc144fc729c83e5b222be2cfe563b32f7a089c","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:4c1fc73c15f695506f10822802bdc1f1e4fbb62496698f77db0da825f6026c89":{"type":"File","value":"4c1fc73c15f695506f10822802bdc1f1e4fbb62496698f77db0da825f6026c89","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 3840x83, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:52c28d2f80b18bd237de3243fdbe326ab1bd278ba52026ee524431f16aa52905":{"type":"File","value":"52c28d2f80b18bd237de3243fdbe326ab1bd278ba52026ee524431f16aa52905"},"File:57a18ac4c40762c100693de41f1b230eefb723cb57ab648f6c36c1e7bd1c78d5":{"type":"File","value":"57a18ac4c40762c100693de41f1b230eefb723cb57ab648f6c36c1e7bd1c78d5","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:5d674e39ffdb024de34ed470de8ed60cc39dfca14b4e2b2653bd93bfdd9fd02f":{"type":"File","value":"5d674e39ffdb024de34ed470de8ed60cc39dfca14b4e2b2653bd93bfdd9fd02f","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d":{"type":"File","value":"68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d"},"File:6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f":{"type":"File","value":"6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f"},"File:6ea07aa4f5565ac289402ade3b2e52bf8089ad6185e0ecf0e1f36cea39c091a9":{"type":"File","value":"6ea07aa4f5565ac289402ade3b2e52bf8089ad6185e0ecf0e1f36cea39c091a9"},"File:724c6e07180e321298b4ea4405c3f7536c524d9826d24f5d6fc50bcb0ef8f723":{"type":"File","value":"724c6e07180e321298b4ea4405c3f7536c524d9826d24f5d6fc50bcb0ef8f723"},"File:7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a":{"type":"File","value":"7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a"},"File:7f733d6e6adb5c9b0d621c6fec8f80965b06638b8802a52660d4b87005384da9":{"type":"File","value":"7f733d6e6adb5c9b0d621c6fec8f80965b06638b8802a52660d4b87005384da9","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061":{"type":"File","value":"87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061"},"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa":{"type":"File","value":"962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa"},"File:9a2af85c88bcf8c84cbca527347798f3f2f5cb79c54e91723da2468a8408a423":{"type":"File","value":"9a2af85c88bcf8c84cbca527347798f3f2f5cb79c54e91723da2468a8408a423","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},"File:a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81":{"type":"File","value":"a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81"},"File:a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8":{"type":"File","value":"a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8"},"File:a84ccbd5083f45bf2d085ad0942619033376d4c5ed17a9263a4f34826a14c550":{"type":"File","value":"a84ccbd5083f45bf2d085ad0942619033376d4c5ed17a9263a4f34826a14c550"},"File:c3cd235fbdc232e2fed992521b3f7c8299aae45b76b6c12857715e4bc8c22e56":{"type":"File","value":"c3cd235fbdc232e2fed992521b3f7c8299aae45b76b6c12857715e4bc8c22e56"},"File:c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74":{"type":"File","value":"c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74"},"File:cea7653bdb56c54cbbb8b0f5cd573bab04ad5fa1bb09df5a4ac38c36d3726137":{"type":"File","value":"cea7653bdb56c54cbbb8b0f5cd573bab04ad5fa1bb09df5a4ac38c36d3726137","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:d92f7c60256509f74e36d9b5aab041fe44999b1a3910d70aa83c9d01f062ea29":{"type":"File","value":"d92f7c60256509f74e36d9b5aab041fe44999b1a3910d70aa83c9d01f062ea29"},"File:da8e38f403cad334a33f7c2af5616bb3caa8ecf5f64efca4afc4e5eb9014cc6b":{"type":"File","value":"da8e38f403cad334a33f7c2af5616bb3caa8ecf5f64efca4afc4e5eb9014cc6b","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15":{"type":"File","value":"df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15"},"File:ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494":{"type":"File","value":"ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},"File:ed8a485b9984997306ea6b5c6d98b5026a5b7903c1df4c229bf93bf113c78ee9":{"type":"File","value":"ed8a485b9984997306ea6b5c6d98b5026a5b7903c1df4c229bf93bf113c78ee9"},"File:f06a3641f1c8acc1b58b36d167b6166d8211a944cbf14e7e12291592ac5af07a":{"type":"File","value":"f06a3641f1c8acc1b58b36d167b6166d8211a944cbf14e7e12291592ac5af07a","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:f0704bc94035e603f0a403ade054a5b708856e4ad7f84a60d850eae7ab092b3f":{"type":"File","value":"f0704bc94035e603f0a403ade054a5b708856e4ad7f84a60d850eae7ab092b3f"},"File:f182ee5603a0219f8bed2d504a6fc27bce4885b7e8b0f09ce8d330d81218dd32":{"type":"File","value":"f182ee5603a0219f8bed2d504a6fc27bce4885b7e8b0f09ce8d330d81218dd32","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:f4adbcf338ad858725bc6f5c0bbb605e2996f0f48423734f72450b7046e91a1f":{"type":"File","value":"f4adbcf338ad858725bc6f5c0bbb605e2996f0f48423734f72450b7046e91a1f","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 272x60, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb":{"type":"File","value":"f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb"},"File:f84677643d9977aa1e8a4aa8c85a12665d29a4e8292485a0b4df846dd161f824":{"type":"File","value":"f84677643d9977aa1e8a4aa8c85a12665d29a4e8292485a0b4df846dd161f824"},"File:fbbf18f351711497ef2cf2573df7d6aff7cb0e682a3e6edf12d14cbd5f43fa39":{"type":"File","value":"fbbf18f351711497ef2cf2573df7d6aff7cb0e682a3e6edf12d14cbd5f43fa39"}},"chains":[{"id":"1545379527070025080","root":"File:00bde9e1e69822f9d9616889297e62f17ee9735c9c0b20328374230df61579bc","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379527070025081","root":"File:4b95254cc61623c23db4240367cc144fc729c83e5b222be2cfe563b32f7a089c","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379527070025082","root":"File:4c1fc73c15f695506f10822802bdc1f1e4fbb62496698f77db0da825f6026c89","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379527074219387","root":"File:57a18ac4c40762c100693de41f1b230eefb723cb57ab648f6c36c1e7bd1c78d5","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379527074219388","root":"File:5d674e39ffdb024de34ed470de8ed60cc39dfca14b4e2b2653bd93bfdd9fd02f","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379527074219389","root":"File:7f733d6e6adb5c9b0d621c6fec8f80965b06638b8802a52660d4b87005384da9","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379549992435916","root":"File:9a2af85c88bcf8c84cbca527347798f3f2f5cb79c54e91723da2468a8408a423","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"1545379527078413694","root":"File:cea7653bdb56c54cbbb8b0f5cd573bab04ad5fa1bb09df5a4ac38c36d3726137","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379527078413695","root":"File:da8e38f403cad334a33f7c2af5616bb3caa8ecf5f64efca4afc4e5eb9014cc6b","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379548176302277","root":"File:ed79c8f65b02ed83d5db8c355328294a73dc447f08f657312bf8f3a5b40c7494","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"1545379527078413696","root":"File:f06a3641f1c8acc1b58b36d167b6166d8211a944cbf14e7e12291592ac5af07a","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379527082608001","root":"File:f182ee5603a0219f8bed2d504a6fc27bce4885b7e8b0f09ce8d330d81218dd32","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1545379527082608002","root":"File:f4adbcf338ad858725bc6f5c0bbb605e2996f0f48423734f72450b7046e91a1f","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"sandbox_files","root":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","edges":[{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:f84677643d9977aa1e8a4aa8c85a12665d29a4e8292485a0b4df846dd161f824"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:d92f7c60256509f74e36d9b5aab041fe44999b1a3910d70aa83c9d01f062ea29"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:ed8a485b9984997306ea6b5c6d98b5026a5b7903c1df4c229bf93bf113c78ee9"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:4004ba624f8ce381c61c82aba26e246d93e833357930c17cd4b02058ea31fad4"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:c3cd235fbdc232e2fed992521b3f7c8299aae45b76b6c12857715e4bc8c22e56"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:fbbf18f351711497ef2cf2573df7d6aff7cb0e682a3e6edf12d14cbd5f43fa39"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:f0704bc94035e603f0a403ade054a5b708856e4ad7f84a60d850eae7ab092b3f"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:2d32c4f4522bc62f63c7949313434f6ca0eaa6b65b44ee5aa8b6b877988b1aa8"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:724c6e07180e321298b4ea4405c3f7536c524d9826d24f5d6fc50bcb0ef8f723"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:6ea07aa4f5565ac289402ade3b2e52bf8089ad6185e0ecf0e1f36cea39c091a9"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:d92f7c60256509f74e36d9b5aab041fe44999b1a3910d70aa83c9d01f062ea29"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:6ea07aa4f5565ac289402ade3b2e52bf8089ad6185e0ecf0e1f36cea39c091a9"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:a84ccbd5083f45bf2d085ad0942619033376d4c5ed17a9263a4f34826a14c550"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:4a4c7c3705b493944367d390a2256ba1f65a358a2411580fac28075caf934a0d"},{"edge_kind":"extracted","from_key":"File:962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","to_key":"File:52c28d2f80b18bd237de3243fdbe326ab1bd278ba52026ee524431f16aa52905"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":96,"dropped_files_count":0,"extracted_files_count":30,"files_written_count":65,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["installcore","sabsik","downloadassistant","stealer","kryptik","pup","bit","pua","conduit"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"699f9e86a9997950d709497c","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":80,"submit_name":"setup.exe","analysis_start_time":"2026-02-26T01:14:47+00:00","indicators_count":{"informative":224,"suspicious":41,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6956d914c917ec10e4027956","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"setup.exe","analysis_start_time":"2026-01-01T20:29:10+00:00","indicators_count":{"informative":223,"suspicious":42,"malicious":2},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}],"processes":[{"pid":4208,"ppid":0,"name":"setup.exe","command_line":"","sha256":"962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa","normalized_path":"C:\\setup.exe","uid":"00000000-00004208","icon":"$55"},{"pid":2812,"ppid":4208,"name":"setup.tmp","command_line":"/SL5=\"$401CA,3663806,140800,C:\\setup.exe\"","sha256":"09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449","normalized_path":"%TEMP%\\is-BAMKF.tmp\\setup.tmp","parent_uid":"00000000-00004208","uid":"00000000-00002812"}],"all_imported_dlls":["ucrtbase.dll","fltLib.dll","cryptsp.dll","comdlg32.dll","CallbackCtrl.dll","cldapi.dll","win32u.dll","oleaut32.dll","cfgmgr32.dll","IPHLPAPI.DLL","clbcatq.dll","msvcp_win.dll","sspicli.dll","ntdll.dll","msvcrt.dll","sechost.dll","windows.storage.dll","ws2_32.dll","TextInputFramework.dll","globinputhost.dll","botva2.dll","kernel32.dll","powrprof.dll","samcli.dll","iertutil.dll","ntmarta.dll","ntasn1.dll","WindowsCodecs.dll","gdi32full.dll","msctf.dll","CoreUIComponents.dll","WinTypes.dll","idp.dll","innocallback.dll","Windows.Globalization.dll","msimg32.dll","cryptbase.dll","KernelBase.dll","userenv.dll","bcrypt.dll","imm32.dll","propsys.dll","combase.dll","urlmon.dll","VxSSL32.dll","aepic.dll","AcGenral.dll","gdi32.dll","dwmapi.dll","bcryptprimitives.dll","version.dll","dsound.dll","wow64cpu.dll","rpcrt4.dll","shlwapi.dll","msacm32.dll","imagehlp.dll","mpr.dll","CoreMessaging.dll","RstrtMgr.dll","ncrypt.dll","ISDone.dll","GdiPlus.dll","ole32.dll","advapi32.dll","kernel.appcore.dll","profapi.dll","comctl32.dll","wininet.dll","msftedit.dll","devobj.dll","wow64win.dll","shell32.dll","SHCore.dll","uxtheme.dll","shfolder.dll","ExplorerFrame.dll","BASS.dll","wow64.dll","user32.dll","winmm.dll","BCP47Langs.dll","wintb.dll","apphelp.dll","winmmbase.dll","tiptsf.dll","MMDevAPI.dll","TextShaping.dll","Windows.UI.dll","RESAMPLEDMO.DLL","srvcli.dll","msdmo.dll","wow64base.dll","umpdc.dll","wow64con.dll","netutils.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"setup.tmp","sha256":"09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"ISDone.dll","sha256":"c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"botva2.dll","sha256":"450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-lollypop.dll","sha256":"f84677643d9977aa1e8a4aa8c85a12665d29a4e8292485a0b4df846dd161f824","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-magic2_x64.exe","sha256":"d92f7c60256509f74e36d9b5aab041fe44999b1a3910d70aa83c9d01f062ea29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-srep_x64.exe","sha256":"ed8a485b9984997306ea6b5c6d98b5026a5b7903c1df4c229bf93bf113c78ee9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-srep_x86.exe","sha256":"4004ba624f8ce381c61c82aba26e246d93e833357930c17cd4b02058ea31fad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"innocallback.dll","sha256":"6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"razor.dll","sha256":"c3cd235fbdc232e2fed992521b3f7c8299aae45b76b6c12857715e4bc8c22e56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"wintb.dll","sha256":"1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"BASS.dll","sha256":"df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"CLS.ini","sha256":"fbbf18f351711497ef2cf2573df7d6aff7cb0e682a3e6edf12d14cbd5f43fa39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"CallbackCtrl.dll","sha256":"68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"FlushFileCache.exe","sha256":"a4cc6683393795f7b84d0b49eea2d7d7fbe1392bb7612cf39896af6832ffe0b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"MusicButton.png","sha256":"7f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"_setup64.tmp","sha256":"a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"arc.ini","sha256":"f0704bc94035e603f0a403ade054a5b708856e4ad7f84a60d850eae7ab092b3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-lollypop_x64.exe","sha256":"2d32c4f4522bc62f63c7949313434f6ca0eaa6b65b44ee5aa8b6b877988b1aa8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-lollypop_x86.exe","sha256":"724c6e07180e321298b4ea4405c3f7536c524d9826d24f5d6fc50bcb0ef8f723","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-magic2.dll","sha256":"87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-magic2_x86.exe","sha256":"6ea07aa4f5565ac289402ade3b2e52bf8089ad6185e0ecf0e1f36cea39c091a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-magic2l.dll","sha256":"87df573ac240e09ea4941e169fb2d15d5316a1b0e053446b8144e04b1154f061","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-magic2l_x64.exe","sha256":"d92f7c60256509f74e36d9b5aab041fe44999b1a3910d70aa83c9d01f062ea29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"cls-magic2l_x86.exe","sha256":"6ea07aa4f5565ac289402ade3b2e52bf8089ad6185e0ecf0e1f36cea39c091a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"host.cmd","sha256":"4500a02f7883a5f16b4b8dac6dfe7e3eb43bba8ac833258fb029c2a970d82855","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"hosts.exe","sha256":"49bdf4c437cf51ed0b369db9935d2f09883859d96a64593247c89c70e6840119","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"idp.dll","sha256":"f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"rz-1.03.7-stdio.exe","sha256":"a84ccbd5083f45bf2d085ad0942619033376d4c5ed17a9263a4f34826a14c550","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"rz.exe","sha256":"4a4c7c3705b493944367d390a2256ba1f65a358a2411580fac28075caf934a0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"rzw.exe","sha256":"52c28d2f80b18bd237de3243fdbe326ab1bd278ba52026ee524431f16aa52905","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-BAMKF.tmp\\setup.tmp","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\idp.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\innocallback.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\ISDone.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\wintb.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\BASS.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-lollypop.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-lollypop_x64.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-lollypop_x86.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-srep_x64.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-srep_x86.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-magic2.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-magic2_x64.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-magic2_x86.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-magic2l.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-magic2l_x64.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\cls-magic2l_x86.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\FlushFileCache.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\arc.ini","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\CLS.ini","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\CallbackCtrl.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\botva2.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\MusicButton.png","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\music.mp3","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\host.cmd","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\hosts.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\rz.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\rzw.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\razor.dll","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-MBTN5.tmp\\rz-1.03.7-stdio.exe","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"path":"%TEMP%\\is-2D5M2.tmp\\setup.tmp","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\idp.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\innocallback.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\ISDone.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\wintb.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\BASS.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-lollypop.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-lollypop_x64.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-lollypop_x86.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-srep_x64.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-srep_x86.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-magic2.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-magic2_x64.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-magic2_x86.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-magic2l.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-magic2l_x64.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\cls-magic2l_x86.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\FlushFileCache.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\arc.ini","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\CLS.ini","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\CallbackCtrl.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\botva2.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\MusicButton.png","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\music.mp3","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\host.cmd","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\hosts.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\rz.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\rzw.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\razor.dll","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"path":"%TEMP%\\is-456H1.tmp\\rz-1.03.7-stdio.exe","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2812:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2812:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DirectSound DllMain mutex (0x00000AFC)","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"SM0:2812:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"name":"DirectSound DllMain mutex (0x00000AFC)","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"},{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"Local\\SM0:2812:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6956d914c917ec10e4027956"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8196:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8196:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8196:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DirectSound DllMain mutex (0x00002004)","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"Local\\SM0:8196:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"Local\\SM0:8196:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"SM0:8196:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]},{"name":"DirectSound DllMain mutex (0x00002004)","sources":[{"report_type":"sandbox","report_id":"699f9e86a9997950d709497c"}]}]}},"report_ids":{"sandbox_job_ids":["6956d914c917ec10e4027956","699f9e86a9997950d709497c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 962c9254c513… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 962c9254c513…. Threat score 85/100. 0/27 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 962c9254c513… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 962c9254c513…. Threat score 85/100. 0/27 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/962c9254c51396eaa0ea8fe84859292aa251e739b5c0ef733d6a77c4c41b9efa"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 962c9254c513… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 962c9254c513…. Threat score 85/100. 0/27 AV engines flagged this file. 2 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]]