26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 70:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.DOMG Sample 191ee35d59e9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 191ee35d59e9…. Malware family: Trojan.DOMG. Threat score 100/100. 1/27 AV engines flagged this file. 14 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c","keywords":["Malicious","Trojan.DOMG","malware analysis","sandbox report","threat intelligence","191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c"],"about":{"@type":"SoftwareApplication","name":"191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin","applicationCategory":["peexe","executable"],"identifier":"191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.DOMG","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Td4a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001852.00000000.193911.00684000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005240.00000000.194117.72B01000.00000040.mdmp, 00000000-00005240.00000001.196038.72B01000.00000040.mdmp, 00000000-00005240.00000002.196504.00D0D000.00000002.mdmp, 00000000-00005240.00000002.196504.72B01000.00000040.mdmp, 00000000-00005240.00000002.196504.72E06000.00000002.mdmp") Found reference to API "SciterSetTimer" (Indicator: "SetTimer"; Source: "00000000-00005240.00000000.194117.72B01000.00000040.mdmp, 00000000-00005240.00000000.194117.72CDB000.00000004.mdmp, 00000000-00005240.00000001.196038.72B01000.00000040.mdmp, 00000000-00005240.00000002.196504.72B01000.00000040.mdmp")28:T52e,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005240.00000000.194117.007B0000.00000004.mdmp, 00000000-00005240.00000000.194117.72B01000.00000040.mdmp, 00000000-00005240.00000000.194117.72CDB000.00000004.mdmp, 00000000-00005240.00000001.196038.007B0000.00000004.mdmp, 00000000-00005240.00000001.196038.72B01000.00000040.mdmp, 00000000-00005240.00000002.196504.007B0000.00000004.mdmp, 00000000-00005240.00000002.196504.72B01000.00000040.mdmp")29:Ta4e,Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00005240.00000000.194117.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.04C0C000.00000004.mdmp, 00000000-00005240.00000001.196038.065B0000.00000004.mdmp, 00000000-00005240.00000001.196038.07970000.00000004.mdmp, 00000000-00005240.00000002.196504.04DF0000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00005240.00000000.194117.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.04C0C000.00000004.mdmp, 00000000-00005240.00000001.196038.065B0000.00000004.mdmp, 00000000-00005240.00000001.196038.07970000.00000004.mdmp, 00000000-00005240.00000002.196504.04DF0000.00000020.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00005240.00000000.194117.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.04C0C000.00000004.mdmp, 00000000-00005240.00000001.196038.065B0000.00000004.mdmp, 00000000-00005240.00000001.196038.07970000.00000004.mdmp, 00000000-00005240.00000002.196504.04DF0000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005240.00000000.194117.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.04C0C000.00000004.mdmp, 00000000-00005240.00000001.196038.065B0000.00000004.mdmp, 00000000-00005240.00000001.196038.07970000.00000004.mdmp, 00000000-00005240.00000002.196504.04DF0000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00005240.00000000.194117.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.0462C000.00000004.mdmp, 00000000-00005240.00000001.196038.04C0C000.00000004.mdmp, 00000000-00005240.00000001.196038.065B0000.00000004.mdmp, 00000000-00005240.00000001.196038.07970000.00000004.mdmp, 00000000-00005240.00000002.196504.04DF0000.00000020.mdmp") Found reference to "jpIANCUGKriAesVxQ0Nbh" (Indicator: "Aes"; Source: "00000000-00005240.00000000.194117.72B01000.00000040.mdmp, 00000000-00005240.00000000.194117.72CDB000.00000004.mdmp, 00000000-00005240.00000001.196038.72B01000.00000040.mdmp, 00000000-00005240.00000002.196504.72B01000.00000040.mdmp") Found reference to "RC2d_wW" (Indicator: "RC2"; Source: "00000000-00005240.00000000.194117.72B01000.00000040.mdmp, 00000000-00005240.00000001.196038.72B01000.00000040.mdmp, 00000000-00005240.00000002.196504.72B01000.00000040.mdmp")2a:T698,"library\std\src\panicking.rs" Heuristic match: "()/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\pattern.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\cell\once.rs" Heuristic match: "6/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "r/rust/deps\gimli-0.32.0\src\read\line.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\num\wrapping.rs" Heuristic match: "nonesomeaccesserror/rust/deps\object-0.37.3\src\read\coff\symbol.rs" Heuristic match: "library\std\src\env.rs" Heuristic match: "r/rust/deps\addr2line-0.25.0\src\unit.rs" Heuristic match: "/rust/deps\addr2line-0.25.0\src\function.rs" Heuristic match: "w8.gq" Heuristic match: "!3.de"5b:T1b54,Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202013.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202013.crt0g<8qcf^$$%" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0!6a4pu" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://www.microsoft.com0a" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0?wt]1-mlwashington1redmond1microsoft" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://pki.eset.com/crt/csca2020.crt05.0,0*$http://pki.eset.com/crl/csca2020.crl0ib0@00%0" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://pki.eset.com/csp0jte;u" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://pki.eset.com/crt/rootca2020.crt0700.0,&http://pki.eset.com/crl/rootca2020.crl0?806040%0" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://pki.eset.com/csp0elxqj^x8;,*+-*" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://pki.eset.com/crt/tsca2020.crt05.0,0*$http://pki.eset.com/crl/tsca2020.crl0?806040%0" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://pki.eset.com/csp0rleog9[jrg" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://pki.eset.com/csp0'dbgc" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0zeaf$x" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt03http://www.microsoft.com/pkiops/docs/primarycps.htm0@e_.,>d=xz" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://www.microsoft.com0m" - Source: "00000000-00001852.00000000.193911.00AEB000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00005240.00000000.194117.00D4A000.00000002.mdmp") Found URL "http://ns.ahttp://ns.adobe.com/xa://ns.adobe.com/xmp/1.0/dynamicmedia/iptc4xmpcorehttp://iptc.org/std/iptc4xmpcore/1.0/xmlns/microsoftphotohttp://ns.microsoft.com/photo/1.0/http://ns.microsoft.com/photo/1.2/mprihttp://ns.microsoft.com/photo/1.2/t/regioninfo" - Source: "00000000-00005240.00000002.196504.00B80000.00000004.mdmp") Found URL "http://ns.microsoft.com/photo/1.2/t/region" - Source: "00000000-00005240.00000002.196504.00B80000.00000004.mdmp") Found URL "http://www.w3.org/1999mentifier/qual/1.0/xmprightshttp://ns.adobe.com/xap/1.0/rights/xmpmmhttp://ns.adobe.com/xap/1.0/mm/xmpbjhttp://ns.adobe.com/xap/1.0/bj/xmptpghttp://ns.adobe.com/xap/1.0/t/pg/http://ns.adobe.com/pdf/1.3/photoshophttp://ns.adobe.com/photoshop/1.0/tiffhttp://ns.adobe.com/tiff/1.0/exifhttp://ns.ad!http://ns.adobe.com/xap/1.0/g/img/stevtgramfil(x86fileegrame\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:owspowershell\v1.0\;%nvm_home%;%nvm_symlink%;c:\users\hapubws\appdata\local\progripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowjprocessor_architecture=x86processor_architew6432=amd64processor_identifier=intel64" - Source: "00000000-00005240.00000002.196504.00B80000.00000004.mdmp") Found URL "https://go.eset.com" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "http://redirector.eset.systems" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://help.eset.com" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "http://windowsupdate.microsoft.comexplorer.exelinkreferenceguireferrer&guireferrer=%sgui.web.showgui.faq.showgui.websupport.showgui.feedback.showhttps://go.eset.com/supportform?version=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://go.eset.com/product/knowledgebase?lng=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://go.eset.com/product/license-troubleshooting?lng=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://go.eset.com/product/product-troubleshooting?lng=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://help.eset.com/gethelp?product=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://go.eset.com/ehome_security_features?feature=vpn&lng=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://go.eset.com/vpn_apps?lng=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://go.eset.com/ehome_security_features?feature=ip&lng=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://go.eset.com/password_manager_extension?lng=$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "https://msp.eset.comgui.upconvert.show$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "http://phishing.eset.com/report/$" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?f%w0digicert" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0m0k0i/0\0zm0k0i=http://www.microsoft.com/pki/certs/microsoftcodeverifroot.crt08&v:" - Source: "00000000-00005240.00000002.196504.00D0D000.00000002.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00001852.00000000.193911.00677000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/>\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00001852.00000000.193911.00677000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6971618f67260a637004165e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6971618f67260a637004165e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6971618f67260a637004165e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001852.00000000.193911.0068C000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005240.00000000.194117.0462C000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005240.00000001.196038.0462C000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005240.00000001.196038.04C0C000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005240.00000001.196038.065B0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005240.00000001.196038.07970000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005240.00000002.196504.04DF0000.00000020.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007976.00000000.193682.004DC000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6971618f67260a637004165e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6971618f67260a637004165e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6971618f67260a637004165e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\" Risco Software Inc.\"\n \"is-EU2MJ.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"is-VMLJ3.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-M4E34.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-M4M6C.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6971618f67260a637004165e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"