24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 79:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Immirat.B Sample 2b6dfe185b55… — Score 75/100 — Hybrid Analysis","description":"Malicious verdict for sample 2b6dfe185b55…. Malware family: Immirat.B. Threat score 75/100. 1/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","keywords":["Malicious","Immirat.B","malware analysis","sandbox report","threat intelligence","2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260"],"about":{"@type":"SoftwareApplication","name":"Offline_eBIRForms_Package_v7.9.6.2.exe","applicationCategory":["compressed","innosetup"],"identifier":"2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","additionalType":"Malicious sample"},"threatScore":75,"malwareFamily":"Immirat.B","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6c8,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")26:Tc91,Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.00401000.00000020.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")27:T7bb,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp, 00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")28:T618,file/memory contains long string with (Indicator: "HashAlgorithm"; File: "is-86K89.tmp") file/memory contains long string with (Indicator: "CryptoStream"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "KeySizes"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "RandomNumberGenerator"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "is-ACU01.tmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=" (Indicator: "SHA384"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp")29:Tfa3,"Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/CITY.XML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/COUNTRYCODES.XML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/PROVINCE.XML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/RDO.XML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/REGION.XML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/TAXRATE.XML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/TAXTYPECODES.XML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/TOSA.HTML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/XML/TREATYCODES.XML") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/SAVEFILE/README.TXT") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/PROFILE/.GITKEEP") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/PROFILE/README.TXT") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/PROXY.INI") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/RELEASE NOTES.TXT") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/EBFSFTP.EXE") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/EBFSFTP.EXE.CONFIG") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/EBFSFTP.PDB") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/WINSCP.EXE") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/EBIRFORMS/WINSCPNET.DLL") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OFFLINE_EBIRFORMS_PACKAGE_V7.9.6.2.TMP") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKCU\DRIVE\SHELLEX\FOLDEREXTENSIONS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS")2a:T5fe,"Offline_eBIRForms_Package_v7.9.6.2.exe" queried SystemProcessInformation at 00000000-00002600-00000C15-3051714035 [PID: 2600] "Offline_eBIRForms_Package_v7.9.6.2.exe" queried SystemProcessInformation at 00000000-00002600-00000C15-3051723553 [PID: 2600] "Offline_eBIRForms_Package_v7.9.6.2.exe" queried SystemProcessInformation at 00000000-00002600-00000C15-3051873047 [PID: 2600] "Offline_eBIRForms_Package_v7.9.6.2.exe" queried SystemProcessInformation at 00000000-00002600-00000C15-3051881660 [PID: 2600] "Offline_eBIRForms_Package_v7.9.6.2.exe" queried SystemProcessInformation at 00000000-00002600-00000C15-3052024536 [PID: 2600] "Offline_eBIRForms_Package_v7.9.6.2.exe" queried SystemProcessInformation at 00000000-00002600-00000C15-3052032721 [PID: 2600] "Offline_eBIRForms_Package_v7.9.6.2.tmp" queried SystemProcessInformation at 00000000-00002168-00000C15-3052612967 [PID: 2168] "Offline_eBIRForms_Package_v7.9.6.2.tmp" queried SystemProcessInformation at 00000000-00002168-00000C15-3052621362 [PID: 2168] "Offline_eBIRForms_Package_v7.9.6.2.tmp" queried SystemProcessInformation at 00000000-00002168-00000C15-3053069336 [PID: 2168] "Offline_eBIRForms_Package_v7.9.6.2.tmp" queried SystemProcessInformation at 00000000-00002168-00000C15-3053077640 [PID: 2168] "Offline_eBIRForms_Package_v7.9.6.2.tmp" queried SystemProcessInformation at 00000000-00002168-00000C15-3092681402 [PID: 2168] "Offline_eBIRForms_Package_v7.9.6.2.tmp" queried SystemProcessInformation at 00000000-00002168-00000C15-3092689651 [PID: 2168]2b:Tc5e,"Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-23TNA.tmp" to "C:\eBIRForms\unins000.exe" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-K85SF.tmp" to "C:\eBIRForms\BIRForms.exe" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-FNNUG.tmp" to "C:\eBIRForms\cFTPSend.exe" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-IP8HT.tmp" to "C:\eBIRForms\Encrypt.exe" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-LKJ17.tmp" to "C:\eBIRForms\chkt.exe" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-FM4L1.tmp" to "C:\eBIRForms\xml\atcCodes.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-59MSA.tmp" to "C:\eBIRForms\xml\city.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-KISM1.tmp" to "C:\eBIRForms\xml\countryCodes.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-52N0T.tmp" to "C:\eBIRForms\xml\province.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-NDLAD.tmp" to "C:\eBIRForms\xml\rdo.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-KAPQ9.tmp" to "C:\eBIRForms\xml\region.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-S4PAS.tmp" to "C:\eBIRForms\xml\taxRate.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-LPC43.tmp" to "C:\eBIRForms\xml\taxTypeCodes.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-IBS1D.tmp" to "C:\eBIRForms\xml\tosa.html" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\xml\is-K9DG5.tmp" to "C:\eBIRForms\xml\treatyCodes.xml" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\savefile\is-V6M76.tmp" to "C:\eBIRForms\savefile\readme.txt" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\profile\is-EU0SI.tmp" to "C:\eBIRForms\profile\.gitkeep" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\profile\is-0LPIM.tmp" to "C:\eBIRForms\profile\readme.txt" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-BFDPL.tmp" to "C:\eBIRForms\proxy.ini" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-GTMLL.tmp" to "C:\eBIRForms\Release Notes.txt" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-ACU01.tmp" to "C:\eBIRForms\ebfSFTP.exe" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-U6HB2.tmp" to "C:\eBIRForms\ebfSFTP.exe.config" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-193MH.tmp" to "C:\eBIRForms\ebfSFTP.pdb" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-QUVL4.tmp" to "C:\eBIRForms\WinSCP.exe" "Offline_eBIRForms_Package_v7.9.6.2.tmp" renamed original file"C:\eBIRForms\is-86K89.tmp" to "C:\eBIRForms\WinSCPnet.dll"2c:T923,Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00002600-3777-157-00404654 Found reference to API GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00002600-3777-213-004074A0 Found reference to API Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002600-3777-252-00409520 Found reference to API MonitorFromWindow@USER32.DLL at 00000000-00002168-5682-117-0042F614 Found reference to API MonitorFromRect@USER32.DLL at 00000000-00002168-5682-204-00496C14 Found reference to API ShutdownBlockReasonDestroy@USER32.DLL at 00000000-00002168-5682-645-0042EFA4 Found reference to API GetSystemWow64DirectoryA@KERNEL32.DLL at 00000000-00002168-5682-818-0042DD40 Found reference to API ChangeWindowMessageFilterEx@USER32.DLL at 00000000-00002168-5682-1066-0042EE6C Found reference to API ChangeWindowMessageFilter@USER32.DLL at 00000000-00002168-5682-1067-0042EDFC Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00002168-5682-1949-004063F4 Found reference to API RegDeleteKeyExA@KERNEL32.DLL at 00000000-00002168-5682-2429-0042E294 Found reference to API GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00002168-5682-2432-0042E868 Found reference to API Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002168-5682-2706-00453934 Found reference to API GetDiskFreeSpaceExA@KERNEL32.DLL at 00000000-00002168-5682-2737-004565A8 Found reference to API GetProcAddress@KERNEL32.DLL at 00000000-00002168-5682-2743-004574BC Found reference to API MonitorFromWindow@USER32.DLL at 00000000-00002168-5682-2875-004635E4 Found reference to API AllowSetForegroundWindow@USER32.DLL at 00000000-00002168-5682-3038-00478DDC Found reference to API GetFinalPathNameByHandleA@KERNEL32.DLL at 00000000-00002168-5682-3122-004795B8 Found reference to API ShutdownBlockReasonCreate@USER32.DLL at 00000000-00002168-5682-3172-0042EEF8 Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00002168-5682-3200-00484E68 Found reference to API Sleep@KERNEL32.DLL at 00000000-00002168-5682-3387-00493FEC Found reference to API DisableProcessWindowsGhosting@USER32.DLL at 00000000-00002168-5682-3444-0049A250 Found reference to API VerSetConditionMask@NTDLL.DLL at 00000000-00002168-5682-3446-00479E68 Found reference to API NotifyWinEvent@USER32.DLL at 00000000-00002168-5682-3449-0044FD1C2d:Tc77,Assembly shows XOR instruction xor eax EDB88320h in Stream UID: 00000000-00002600-3777-33-00407C28 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00002600-3777-33-00407C28 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00002600-3777-33-00407C28 Assembly shows XOR instruction xor byte ptr [ecx] ch in Stream UID: 00000000-00002600-3777-114-0040102C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-84-00454868 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-352-004775F4 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 00000000-00002168-5682-511-00439B80 Assembly shows XOR instruction xor word ptr [esi] ax in Stream UID: 00000000-00002168-5682-511-00439B80 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 00000000-00002168-5682-511-00439B80 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-530-00437F64 Assembly shows XOR instruction xor dword ptr [eax] esp in Stream UID: 00000000-00002168-5682-639-00482B68 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00002168-5682-685-00451578 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00002168-5682-685-00451578 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-739-00478B28 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-785-00471688 Assembly shows XOR instruction xor dword ptr [ebp+63h] eax in Stream UID: 00000000-00002168-5682-1054-0045E3A8 Assembly shows XOR instruction xor al byte ptr [ebp+63h] in Stream UID: 00000000-00002168-5682-1054-0045E3A8 Assembly shows XOR instruction xor bl byte ptr [edi+62h] in Stream UID: 00000000-00002168-5682-1057-0045DE4C Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00002168-5682-1087-0045034B Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002168-5682-2163-00414148 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00002168-5682-2809-0045CA60 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-2809-0045CA60 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-2950-00468034 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00002168-5682-3399-00494CF4 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-3613-00414830 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00002168-5682-4115-0044D2F0 Assembly shows XOR instruction xor dl 01h in Stream UID: 00000000-00002168-5682-4134-0044F234 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-4134-0044F234 Assembly shows XOR instruction xor esi 02h in Stream UID: 00000000-00002168-5682-4473-00483210 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002168-5682-6270-00418509 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002168-5682-6383-0044F488 Assembly shows XOR instruction xor dh byte ptr [eax] in Stream UID: 00000000-00002168-5682-6389-004505B82e:T2eae,Found XOR loop in file "is-QUVL4.tmp" at offset 3589604; code bytes = 30d0 Found XOR loop in file "is-QUVL4.tmp" at offset 3710595; code bytes = 30d0 Found XOR loop in file "is-QUVL4.tmp" at offset 4570982; code bytes = 30d0 Found XOR loop in file "is-QUVL4.tmp" at offset 1473190; code bytes = 33c1 Found XOR loop in file "is-QUVL4.tmp" at offset 2478893; code bytes = 33c1 Found XOR loop in file "is-QUVL4.tmp" at offset 3513103; code bytes = 33c1 Found XOR loop in file "is-QUVL4.tmp" at offset 3914315; code bytes = 33c1 Found XOR loop in file "is-QUVL4.tmp" at offset 103191; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 370491; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 386968; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 419168; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1068881; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1074608; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1427640; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1427667; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428077; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428104; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428343; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428367; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428592; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428673; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428696; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428720; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428748; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 1428772; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 2246136; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 2485139; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 3680154; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 3868290; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 3872389; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 3882324; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 3903619; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 3906538; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 3916653; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4068645; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4078770; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4088131; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4114779; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4129735; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4154230; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4161172; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4186395; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4252393; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4252805; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4369797; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4369891; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4369951; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4370785; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4480648; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4502307; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4507389; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4813829; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4832499; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4875676; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 4988909; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5013065; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5040146; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5096528; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5126330; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5139192; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5146328; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5150608; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5150636; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5150689; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5150715; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5150740; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5150760; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5150789; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5150835; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5151396; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5151476; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5151533; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5151612; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5151981; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5152021; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5152065; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5152101; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5152113; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5152261; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5152305; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5152321; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5152333; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5174578; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5178760; code bytes = 8030 Found XOR loop in file "is-QUVL4.tmp" at offset 5229121; code bytes = 8030 Found XOR loop in file "is-K85SF.tmp" at offset 317290; code bytes = 30d0 Found XOR loop in file "is-K85SF.tmp" at offset 93123; code bytes = 33c1 Found XOR loop in file "is-K85SF.tmp" at offset 94717; code bytes = 33c1 Found XOR loop in file "is-K85SF.tmp" at offset 94846; code bytes = 33c1 Found XOR loop in file "is-K85SF.tmp" at offset 248383; code bytes = 8030 Found XOR loop in file "is-K85SF.tmp" at offset 250431; code bytes = 8030 Found XOR loop in file "is-K85SF.tmp" at offset 318560; code bytes = 8030 Found XOR loop in file "is-K85SF.tmp" at offset 326154; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 7083; code bytes = 30d0 Found XOR loop in file "is-23TNA.tmp" at offset 7510; code bytes = 30d0 Found XOR loop in file "is-23TNA.tmp" at offset 7521; code bytes = 30d0 Found XOR loop in file "is-23TNA.tmp" at offset 19174; code bytes = 30d0 Found XOR loop in file "is-23TNA.tmp" at offset 242916; code bytes = 33c1 Found XOR loop in file "is-23TNA.tmp" at offset 123961; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 132875; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 135574; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 135656; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 139838; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 139964; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 140421; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 152813; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 154763; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 163710; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 377463; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 401701; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 423737; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 423756; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 423781; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 431859; code bytes = 8030 Found XOR loop in file "is-23TNA.tmp" at offset 553385; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 7083; code bytes = 30d0 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 7510; code bytes = 30d0 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 7521; code bytes = 30d0 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 19174; code bytes = 30d0 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 242916; code bytes = 33c1 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 123961; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 132875; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 135574; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 135656; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 139838; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 139964; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 140421; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 152813; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 154763; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 163710; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 377463; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 401701; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 423737; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 423756; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 423781; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 431859; code bytes = 8030 Found XOR loop in file "Offline_eBIRForms_Package_v7.9.6.2.tmp" at offset 553385; code bytes = 8030 Found XOR loop in file "is-IP8HT.tmp" at offset 50885; code bytes = 30d0 Found XOR loop in file "is-IP8HT.tmp" at offset 137941; code bytes = 30d0 Found XOR loop in file "is-IP8HT.tmp" at offset 137964; code bytes = 30d0 Found XOR loop in file "is-IP8HT.tmp" at offset 137987; code bytes = 30d0 Found XOR loop in file "is-FNNUG.tmp" at offset 3502; code bytes = 8030 Found XOR loop in file "is-FNNUG.tmp" at offset 3511; code bytes = 8030 Found XOR loop in file "is-FNNUG.tmp" at offset 4695; code bytes = 8030 Found XOR loop in file "is-FNNUG.tmp" at offset 132892; code bytes = 8030 Found XOR loop in file "is-86K89.tmp" at offset 52469; code bytes = 8030 Found XOR loop in file "is-86K89.tmp" at offset 75672; code bytes = 8030 Found XOR loop in file "is-86K89.tmp" at offset 146727; code bytes = 8030 Found XOR loop in file "is-86K89.tmp" at offset 148583; code bytes = 8030 Found XOR loop in file "is-86K89.tmp" at offset 154195; code bytes = 8030 Found XOR loop in file "is-86K89.tmp" at offset 157269; code bytes = 80302f:T470,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResourceA"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResourceA"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp")30:T577,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "is-K85SF.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-LKJ17.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")31:T4ea,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002168-00000C2C-3052989037") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp")32:T514,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")33:T507,Found system information discovery API: "GetSystemInfo" in file "Offline_eBIRForms_Package_v7.9.6.2.exe" Found system information discovery API: "GetSystemInfo" in "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00002168.00000000.269871.73217000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00002168.00000001.271789.731B1000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002168.00000002.272832.004A3000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00002168.00000002.272832.004A3000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp"34:T552,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002600.00000001.271690.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")35:T1075,file/memory contains long string with (Indicator: "sendmessage"; File: "is-K85SF.tmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "InSendMessageEx" (Indicator: "sendmessage"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;" (Indicator: "sendmessage"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;" (Indicator: "postmessage"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp")36:T797,"Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "Welcome to the eBIRForms Setup Wizard" - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "This will install eBIRForms version v7.9.6.2 on your computer.It is recommended that you close all other applications before c" - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "Select Destination Location" - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "Where should eBIRForms be installed?" - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "Select a folder in the list below, then click OK." - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "Setup will install eBIRForms into the following folder." - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "To continue, click Next. If you would like to select a different folder, click Browse." - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "B&rowse..." - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "At least 81.0 MB of free disk space is required." - (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00002168)37:T1ed6,"Offline_eBIRForms_Package_v7.9.6.2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02cff75b4f45100226ec77500005e04000000002d6ec775ce2197932d000000ecb7f57538f551000a000000409ebe02d88abd02020000008000000078f4510000003e00fcf4510070c8c87582a40be6feffffff2d000000d0cc047627000000ccf45100856ac9751c23ce750cf55100f85fc97508000000bb69c875b269c875762097932d000000ecb7f57527000000d0cc0476e0f451002d000000d0cc04762700000010f55100856ac9751c23ce7558f551007e8a0376ee8c0376738a03764ddac2cc2d000000ecb7f57527000000d0cc0476b4115e0448115e044ddac2cc20f55100fc5241760cf65100e08403762ddeacbafeffffff738a0376 (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8c0930038cf2b77043aac0234c1930001000000b839ac02043aac02b839ac02040000000400000000e0bd750010000034c1930001000000b839ac02cd972b779c972b771a7a6694b50fb475b839ac0200002b7700000000c4212a750000000080eeba750100000060e9b202f8e2bd750000000004000000000000004840bc75f8e2bd7538c1930080e89a742098ac0280e89a7434c193000000000080e89a7460e9b2020000ac020000000032ee29770000ac023b00000000000000fc1d00007f070000d06a0000ff070000d06a0000d06a00000000ac020000000000000000ffffffff0000000000000000000000002e6eb702446eb702 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8c0930038cf2b77043aac0234c1930001000000b839ac02043aac02b839ac02040000000400000000e0bd750010000034c1930001000000b839ac02cd972b779c972b771a7a6694b50fb475b839ac0200002b7700000000c4212a750000000080eeba750100000060e9b202f8e2bd750000000004000000000000004840bc75f8e2bd7538c1930080e89a742098ac0280e89a7434c193000000000080e89a7460e9b2020000ac020000000032ee29770000ac023b00000000000000fc1d00007f070000d06a0000ff070000d06a0000d06a00000000ac020000000000000000ffffffff0000000000000000000000005e23b8027623b802 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8c0930038cf2b77043aac0234c1930001000000b839ac02043aac02b839ac02040000000400000000e0bd750010000034c1930001000000b839ac02cd972b779c972b771a7a6694b50fb475b839ac0200002b7700000000c4212a750000000080eeba750100000060e9b202f8e2bd750000000004000000000000004840bc75f8e2bd7538c1930080e89a742098ac0280e89a7434c193000000000080e89a7460e9b2020000ac020000000032ee29770000ac023b00000000000000fc1d00007f070000d06a0000ff070000d06a0000d06a00000000ac020000000000000000ffffffff0000000000000000000000000e26b8022226b802 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8c0930038cf2b77043aac0234c1930001000000b839ac02043aac02b839ac02040000000400000000e0bd750010000034c1930001000000b839ac02cd972b779c972b771a7a6694b50fb475b839ac0200002b7700000000c4212a750000000080eeba750100000060e9b202f8e2bd750000000004000000000000004840bc75f8e2bd7538c1930080e89a742098ac0280e89a7434c193000000000080e89a7460e9b2020000ac020000000032ee29770000ac023b00000000000000fc1d00007f070000d06a0000ff070000d06a0000d06a00000000ac020000000000000000ffffffff0000000000000000000000003e36b8025636b802 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8c0930038cf2b77043aac0234c1930001000000b839ac02043aac02b839ac02040000000400000000e0bd750010000034c1930001000000b839ac02cd972b779c972b771a7a6694b50fb475b839ac0200002b7700000000c4212a750000000080eeba750100000060e9b202f8e2bd750000000004000000000000004840bc75f8e2bd7538c1930080e89a742098ac0280e89a7434c193000000000080e89a7460e9b2020000ac020000000032ee29770000ac023b00000000000000fc1d00007f070000d06a0000ff070000d06a0000d06a00000000ac020000000000000000ffffffff0000000000000000000000005639b8026c39b802 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8c0930038cf2b77043aac0234c1930001000000b839ac02043aac02b839ac02040000000400000000e0bd750010000034c1930001000000b839ac02cd972b779c972b771a7a6694b50fb475b839ac0200002b7700000000c4212a750000000080eeba750100000060e9b202f8e2bd750000000004000000000000004840bc75f8e2bd7538c1930080e89a742098ac0280e89a7434c193000000000080e89a7460e9b2020000ac020000000032ee29770000ac023b00000000000000fc1d00007f070000d06a0000ff070000d06a0000d06a00000000ac020000000000000000ffffffff000000000000000000000000064bb8021e4bb802 (UID: 00000000-00002168)38:Tafc,"Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000214000acfe5100482140004f21400098aa400098aa4000030000008c0398046c03980420000000c5224000d8fe5100ee224000f522400098aa400003000000c4fe510000000000d0fe5100b6254000dd31400098aa4000090400005b5a4000635a400098aa400098aa400000106a00000000000000000000000000f0fe5100 (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000002140004cfb9300fc2140000322400090a4490090a44900030000008c03c3046c03c304200000007923400078fb9300a2234000a923400090a449000300000064fb93000000000070fb93006a2640004534400090a4490009040000b78d4000bf8d400090a4490090a4490000e06f0000000000000000000000000090fb9300 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000007a0e43000000000008fb93007fc0002e000e430000000000f0fa930060fb9300a4fb930050d47174d9815c92feffffff1c2f6f74632b6f7460fb930000000000b0fb9300370e430060fb9300576e6450726f6350747230303430303030303030303030393638000000a44900000040000008010d6809000000e06f00 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fb93004d6da37300000000b0fb9300cffc4400fcfa9300940000000a00000000000000ab3f000002000000000000007a0e43000000000008fb93007fc0002e000e430000000000f0fa930060fb9300a4fb930050d47174d9815c92feffffff1c2f6f74632b6f7460fb930000000000b0fb9300370e430060fb9300576e6450 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f2436694f0fa930011b9b17500006174e4fa930000000000 (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetVersionExA" with parameter 9c0000000a00000000000000ab3f00000200000000001000904f48004042647404fb9300c4506c7400006174904f48006feba0732cfb93006feba07300006174904f480090a4490020596c740000617400000000904f48000000000090fb9300e74e480000006174904f480001000000090000000010000000000100fffffeffff00000008000000d8210000000001000600004f (UID: 00000000-00002168)39:T5a2,GetVersion@KERNEL32.DLL at 00000000-00002600-3777-157-00404654 GetVersionExA@KERNEL32.DLL at 00000000-00002600-3777-183-00406144 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-603-0046EE04 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-714-0045D3BC GetVersion@KERNEL32.DLL at 00000000-00002168-5682-1949-004063F4 GetVersionExA@KERNEL32.DLL at 00000000-00002168-5682-1980-004094C0 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-2138-00411B44 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-2425-0042DDC4 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-2430-0042E4EC GetVersionExA@KERNEL32.DLL at 00000000-00002168-5682-2593-0044BAA4 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-2684-00450994 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-2876-004638CC GetVersion@KERNEL32.DLL at 00000000-00002168-5682-2879-00463A24 GetVersionExA@KERNEL32.DLL at 00000000-00002168-5682-3199-00485194 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-3442-0049A490 GetVersionExA@KERNEL32.DLL at 00000000-00002168-5682-3448-004501E8 GetVersionExA@KERNEL32.DLL at 00000000-00002168-5682-3450-0044FCAC GetVersion@KERNEL32.DLL at 00000000-00002168-5682-3455-00419490 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-3458-0041F568 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-4287-00463984 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-4288-004637D4 GetVersion@KERNEL32.DLL at 00000000-00002168-5682-6383-0044F4883a:T4fa,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp")3b:Tbb9,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "61742,2408,109,,GetWindowTextW,user32.dll,"01:10:12.937",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002168.00000000.269871.02AC0000.00000004.mdmp") Found reference to API "6029154172,2408,109,,GetWindowTextW,user32.dll,"01:10:43.718",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "EnumDesktops" (Indicator: "EnumDesktops"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to API "22098477159,2408,110,,EnumWindows,user32.dll,"01:11:02.921",RX=0,PX=0" (Indicator: "EnumWindows"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp")3c:Tc6d,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")3d:T8ad,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 004046A5h" at 00000000-00002600-3777-157-00404654 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 0046EE48h" at 00000000-00002168-5682-603-0046EE04 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 0045D3F1h" at 00000000-00002168-5682-714-0045D3BC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 00406445h" at 00000000-00002168-5682-1949-004063F4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "jc 00411CA4h" at 00000000-00002168-5682-2138-00411B44 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0042DE1Fh" at 00000000-00002168-5682-2425-0042DDC4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0042E569h" at 00000000-00002168-5682-2430-0042E4EC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 00450A8Ch" at 00000000-00002168-5682-2684-00450994 Found API call GetDiskFreeSpaceA@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 004566AFh" at 00000000-00002168-5682-2737-004565A8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 00463941h" at 00000000-00002168-5682-2876-004638CC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 00463A97h" at 00000000-00002168-5682-2879-00463A24 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "setnb byte ptr [0049D5C8h]" at 00000000-00002168-5682-3455-00419490 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp bl, 04h" and "jnc 0041F5B1h" at 00000000-00002168-5682-3458-0041F568 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004639FEh" at 00000000-00002168-5682-4287-00463984 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp dx, 0005h" and "jne 0046385Bh" at 00000000-00002168-5682-4288-004637D4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jne 0044F533h" at 00000000-00002168-5682-6383-0044F4883e:T8d2,"Offline_eBIRForms_Package_v7.9.6.2.exe" called "CreateDirectoryA" with parameter %TEMP%\is-UB103.tmp (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-C7QRN.tmp (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-C7QRN.tmp\_isetup (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\temp (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\success (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\failed (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\logfile (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\IAF_RDO_Copy (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\IAF_RDC_Copy (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\IAF_Proj_Copy (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\IAF_RDO_Archive (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\IAF_RDC_Archive (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\savefile (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter C:\eBIRForms\profile (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\eBIRForms (UID: 00000000-00002168)3f:Tf97,"Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-23TNA.tmp & C:\eBIRForms\unins000.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-K85SF.tmp & C:\eBIRForms\BIRForms.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-FNNUG.tmp & C:\eBIRForms\cFTPSend.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-IP8HT.tmp & C:\eBIRForms\Encrypt.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-LKJ17.tmp & C:\eBIRForms\chkt.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-FM4L1.tmp & C:\eBIRForms\xml\atcCodes.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-59MSA.tmp & C:\eBIRForms\xml\city.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-KISM1.tmp & C:\eBIRForms\xml\countryCodes.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-52N0T.tmp & C:\eBIRForms\xml\province.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-NDLAD.tmp & C:\eBIRForms\xml\rdo.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-KAPQ9.tmp & C:\eBIRForms\xml\region.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-S4PAS.tmp & C:\eBIRForms\xml\taxRate.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-LPC43.tmp & C:\eBIRForms\xml\taxTypeCodes.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-IBS1D.tmp & C:\eBIRForms\xml\tosa.html (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\xml\is-K9DG5.tmp & C:\eBIRForms\xml\treatyCodes.xml (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\savefile\is-V6M76.tmp & C:\eBIRForms\savefile\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\profile\is-EU0SI.tmp & C:\eBIRForms\profile\.gitkeep (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\profile\is-0LPIM.tmp & C:\eBIRForms\profile\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-BFDPL.tmp & C:\eBIRForms\proxy.ini (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-GTMLL.tmp & C:\eBIRForms\Release Notes.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-ACU01.tmp & C:\eBIRForms\ebfSFTP.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-U6HB2.tmp & C:\eBIRForms\ebfSFTP.exe.config (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-193MH.tmp & C:\eBIRForms\ebfSFTP.pdb (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-QUVL4.tmp & C:\eBIRForms\WinSCP.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "MoveFileA" with parameter C:\eBIRForms\is-86K89.tmp & C:\eBIRForms\WinSCPnet.dll (UID: 00000000-00002168)40:T3351,"Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002600) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteA (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00002168)41:T531,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "CreateProcess failed (%d)." (Indicator: "CreateProcess"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "CreateProcess failed (%d)." (Indicator: "CreateProcess"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "33783,5216,3142,,CreateProcessA,kernel32.dll,"01:10:11.718",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00002600.00000001.271690.02BD0000.00000004.mdmp")42:T536,Sleep@KERNEL32.DLL at 00000000-00002600-3777-263-00409978 MsgWaitForMultipleObjects at 00000000-00002600-3777-275-00409E8C WaitForSingleObject@KERNEL32.DLL at 00000000-00002168-5682-107-00459240 Sleep@KERNEL32.DLL at 00000000-00002168-5682-695-0042F2A4 MsgWaitForMultipleObjects at 00000000-00002168-5682-719-00459418 SetTimer at 00000000-00002168-5682-2344-00424F7C MsgWaitForMultipleObjects at 00000000-00002168-5682-2723-004556E4 Sleep@KERNEL32.DLL at 00000000-00002168-5682-2729-00455E10 MsgWaitForMultipleObjects at 00000000-00002168-5682-2766-004587F4 Sleep@KERNEL32.DLL at 00000000-00002168-5682-3015-0046C0E0 MsgWaitForMultipleObjects at 00000000-00002168-5682-3036-00478EB4 MsgWaitForMultipleObjects at 00000000-00002168-5682-3098-0042F0C4 Sleep@KERNEL32.DLL at 00000000-00002168-5682-3114-00471504 MsgWaitForMultipleObjects at 00000000-00002168-5682-3123-0047974C Sleep@KERNEL32.DLL at 00000000-00002168-5682-3387-00493FEC WaitForSingleObject@KERNEL32.DLL at 00000000-00002168-5682-3418-00497DDC MsgWaitForMultipleObjects at 00000000-00002168-5682-3424-00498538 Sleep@KERNEL32.DLL at 00000000-00002168-5682-3431-00498914 MsgWaitForMultipleObjects at 00000000-00002168-5682-3438-00499CB8 Sleep@KERNEL32.DLL at 00000000-00002168-5682-4404-00477207 Sleep@KERNEL32.DLL at 00000000-00002168-5682-4443-0047E05443:T654,Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp")44:Tc93,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FindResourceExA" (Indicator: "FindResource"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.00401000.00000020.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")45:T5d8,Found reference to API "MoveFileEx" (Indicator: "MoveFile"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "MoveFileEx" (Indicator: "MoveFile"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp")46:T450,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")47:T454,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp")48:T50a,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")49:T14d9,"SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 5682-590-00459C54 "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 5682-590-00459C54 "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 5682-590-00459C54 "SOFTWARE\Microsoft\.NETFramework" in Source: 5682-591-00459B60 "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 5682-690-0047A0E0 "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 5682-769-00473FD0 "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 5682-802-00454C90 "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 5682-2730-00455E74 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 5682-3050-0046FE70 "Software\Microsoft\Windows\CurrentVersion" in Source: 5682-3138-0047D800 "System\CurrentControlSet\Control\Windows" in Source: 5682-3195-00484FB0 "System\CurrentControlSet\Control\ProductOptions" in Source: 5682-3196-00485058 "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 5682-4286-004637FB "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 5682-4393-00475565 "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002168.00000000.269871.02AC0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002168.00000000.269871.02AC0000.00000004.mdmp 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002168.00000001.271789.731B1000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00002168.00000001.271789.731B1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00002168.00000001.271789.731B1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00002168.00000001.271789.731B1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002168.00000002.272832.004A3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002168.00000002.272832.004A3000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002168.00000002.272832.004A3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00002168.00000002.272832.004A3000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S" in Source: 00000000-00002168.00000002.272832.0092B000.00000004.mdmp4a:T1014,Process Offline_eBIRForms_Package_v7.9.6.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2600:168:WilStaging_02" Process Offline_eBIRForms_Package_v7.9.6.2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2600:168:WilStaging_02" Process Offline_eBIRForms_Package_v7.9.6.2.exe created mutex with name "Local\SM0:2600:168:WilStaging_02" Process Offline_eBIRForms_Package_v7.9.6.2.exe created mutex with name "SM0:2600:168:WilStaging_02" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2168:168:WilStaging_02" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2168:168:WilStaging_02" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2168:64:WilError_01" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process Offline_eBIRForms_Package_v7.9.6.2.tmp created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit"4b:T7f0,Antivirus vendors marked dropped file "Uninstall.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID qn95iv1bsiognh2 Archive ctime=Sat Oct 3 23:21:52 2026 atime=Sat Oct 3 23:21:52 2026 mtime=Sat Oct 3 23:21:09 2026 length=725157 window=normal IDListSize 0x00f1 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\eBIRForms\unins000.exe"") Antivirus vendors marked dropped file "eBIRForms.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID qn95iv1bsiognh2 Archive ctime=Sat Oct 3 23:21:52 2026 atime=Sat Oct 3 23:21:52 2026 mtime=Mon Sep 28 18:00:16 2026 length=58599936 window=normal IDListSize 0x00f1 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\eBIRForms\BIRForms.exe"") Antivirus vendors marked dropped file "is-23TNA.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"), Antivirus vendors marked dropped file "is-IP8HT.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (console) Intel i386 7 sections"), Antivirus vendors marked dropped file "is-FNNUG.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 5 sections"), Antivirus vendors marked dropped file "is-86K89.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "is-LKJ17.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 5 sections"), Antivirus vendors marked dropped file "is-ACU01.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "_setup64.tmp" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections")4c:T11c0,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002168.00000000.269871.02AC0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002168.00000000.269871.02AC0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002168.00000001.271789.731B1000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00002168.00000001.271789.731B1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00002168.00000001.271789.731B1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00002168.00000001.271789.731B1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002168.00000002.272832.004A3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002168.00000002.272832.004A3000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002168.00000002.272832.004A3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00002168.00000002.272832.004A3000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S" in Source: 00000000-00002168.00000002.272832.0092B000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp4d:Td10,"Offline_eBIRForms_Package_v7.9.6.2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738d0000 "Offline_eBIRForms_Package_v7.9.6.2.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75f30000 "Offline_eBIRForms_Package_v7.9.6.2.exe" loaded module "COMCTL32.DLL" at base 73a60000 "Offline_eBIRForms_Package_v7.9.6.2.exe" loaded module "KERNEL32.DLL" at base 746b0000 "Offline_eBIRForms_Package_v7.9.6.2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73850000 "Offline_eBIRForms_Package_v7.9.6.2.exe" loaded module "NTDLL.DLL" at base 77270000 "Offline_eBIRForms_Package_v7.9.6.2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73780000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 738d0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73850000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "KERNEL32.DLL" at base 746b0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "OLEAUT32.DLL" at base 75d10000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "RPCRT4.DLL" at base 74390000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 73d10000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 73d10000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74140000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 73ef0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75f30000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 732e0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 732b0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74820000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "COMCTL32" at base 73a60000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "COMCTL32.DLL" at base 73a60000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 75860000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 731b0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 755a0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 72ec0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 72e70000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "NTDLL.DLL" at base 77270000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "SSPICLI.DLL" at base 73c90000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 729d0000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 6050000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74890000 "Offline_eBIRForms_Package_v7.9.6.2.tmp" loaded module "CSCAPI.DLL" at base 728a00004e:T817,"Offline_eBIRForms_Package_v7.9.6.2.exe" was detected as "Inno Setup Module" and name: "Installer" "Offline_eBIRForms_Package_v7.9.6.2.exe" was detected as "Borland Delphi" and name: "Compiler" "Offline_eBIRForms_Package_v7.9.6.2.exe" was detected as "Turbo Linker" and name: "Linker" "is-23TNA.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-23TNA.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-23TNA.tmp" was detected as "Turbo Linker" and name: "Linker" "Offline_eBIRForms_Package_v7.9.6.2.tmp" was detected as "Inno Setup Module" and name: "Installer" "Offline_eBIRForms_Package_v7.9.6.2.tmp" was detected as "Borland Delphi" and name: "Compiler" "Offline_eBIRForms_Package_v7.9.6.2.tmp" was detected as "Turbo Linker" and name: "Linker" "is-IP8HT.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-IP8HT.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-IP8HT.tmp" was detected as "Turbo Linker" and name: "Linker" "is-FNNUG.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-FNNUG.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-FNNUG.tmp" was detected as "Turbo Linker" and name: "Linker" "is-86K89.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-86K89.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-86K89.tmp" was detected as "Turbo Linker" and name: "Linker" "is-LKJ17.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-LKJ17.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-LKJ17.tmp" was detected as "Turbo Linker" and name: "Linker" "is-ACU01.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-ACU01.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-ACU01.tmp" was detected as "Turbo Linker" and name: "Linker" "_setup64.tmp" was detected as "Inno Setup Module" and name: "Installer" "_setup64.tmp" was detected as "Borland Delphi" and name: "Compiler" "_setup64.tmp" was detected as "Turbo Linker" and name: "Linker"4f:T62e,"Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\TREATAS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "Offline_eBIRForms_Package_v7.9.6.2.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS")50:T5a3,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "LoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")51:T1502,"Uninstall.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID qn95iv1bsiognh2 Archive ctime=Sat Oct 3 23:21:52 2026 atime=Sat Oct 3 23:21:52 2026 mtime=Sat Oct 3 23:21:09 2026 length=725157 window=normal IDListSize 0x00f1 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\eBIRForms\unins000.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\eBIRForms\Uninstall.lnk]- [targetUID: 00000000-00002168] "eBIRForms.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID qn95iv1bsiognh2 Archive ctime=Sat Oct 3 23:21:52 2026 atime=Sat Oct 3 23:21:52 2026 mtime=Mon Sep 28 18:00:16 2026 length=58599936 window=normal IDListSize 0x00f1 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\eBIRForms\BIRForms.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\eBIRForms\eBIRForms.lnk]- [targetUID: 00000000-00002168] "is-QUVL4.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 (stripped to external PDB) 9 sections"- Location: [C:\eBIRForms\is-QUVL4.tmp]- [targetUID: 00000000-00002168] "is-K85SF.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [C:\eBIRForms\is-K85SF.tmp]- [targetUID: 00000000-00002168] "is-23TNA.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [C:\eBIRForms\is-23TNA.tmp]- [targetUID: 00000000-00002168] "Offline_eBIRForms_Package_v7.9.6.2.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-UB103.tmp\Offline_eBIRForms_Package_v7.9.6.2.tmp]- [targetUID: 00000000-00002600] "is-IP8HT.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 7 sections"- Location: [C:\eBIRForms\is-IP8HT.tmp]- [targetUID: 00000000-00002168] "is-FNNUG.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 5 sections"- Location: [C:\eBIRForms\is-FNNUG.tmp]- [targetUID: 00000000-00002168] "is-59MSA.tmp" has type "XML 1.0 document Unicode text UTF-8 text"- Location: [C:\eBIRForms\xml\is-59MSA.tmp]- [targetUID: 00000000-00002168] "is-86K89.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [C:\eBIRForms\is-86K89.tmp]- [targetUID: 00000000-00002168] "is-FM4L1.tmp" has type "XML 1.0 document ASCII text with very long lines (374)"- Location: [C:\eBIRForms\xml\is-FM4L1.tmp]- [targetUID: 00000000-00002168] "is-GTMLL.tmp" has type "Unicode text UTF-8 (with BOM) text with very long lines (330) with CRLF line terminators"- Location: [C:\eBIRForms\is-GTMLL.tmp]- [targetUID: 00000000-00002168] "is-NDLAD.tmp" has type "XML 1.0 document ASCII text"- Location: [C:\eBIRForms\xml\is-NDLAD.tmp]- [targetUID: 00000000-00002168] "is-LKJ17.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 5 sections"- Location: [C:\eBIRForms\is-LKJ17.tmp]- [targetUID: 00000000-00002168] "is-193MH.tmp" has type "MSVC program database ver 7.00 512*43 bytes"- Location: [C:\eBIRForms\is-193MH.tmp]- [targetUID: 00000000-00002168] "is-KISM1.tmp" has type "XML 1.0 document Unicode text UTF-8 text"- Location: [C:\eBIRForms\xml\is-KISM1.tmp]- [targetUID: 00000000-00002168] "is-S4PAS.tmp" has type "HTML document Unicode text UTF-8 text"- Location: [C:\eBIRForms\xml\is-S4PAS.tmp]- [targetUID: 00000000-00002168] "is-IBS1D.tmp" has type "Unicode text UTF-8 text with very long lines (584)"- Location: [C:\eBIRForms\xml\is-IBS1D.tmp]- [targetUID: 00000000-00002168] "is-52N0T.tmp" has type "XML 1.0 document ASCII text"- Location: [C:\eBIRForms\xml\is-52N0T.tmp]- [targetUID: 00000000-00002168] "is-ACU01.tmp" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [C:\eBIRForms\is-ACU01.tmp]- [targetUID: 00000000-00002168] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-C7QRN.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002168] "is-LPC43.tmp" has type "XML 1.0 document ASCII text"- Location: [C:\eBIRForms\xml\is-LPC43.tmp]- [targetUID: 00000000-00002168] "is-K9DG5.tmp" has type "XML 1.0 document ASCII text"- Location: [C:\eBIRForms\xml\is-K9DG5.tmp]- [targetUID: 00000000-00002168] "unins000.dat" has type "InnoSetup Log eBIRForms version 0x30 2740 bytes qN95iv1bsIOgNh2\DFXgGN9 "C:\eBIRForms""- Location: [C:\eBIRForms\unins000.dat]- [targetUID: 00000000-00002168] "is-KAPQ9.tmp" has type "XML 1.0 document ASCII text"- Location: [C:\eBIRForms\xml\is-KAPQ9.tmp]- [targetUID: 00000000-00002168] "is-U6HB2.tmp" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text"- Location: [C:\eBIRForms\is-U6HB2.tmp]- [targetUID: 00000000-00002168] "is-BFDPL.tmp" has type "ASCII text"- Location: [C:\eBIRForms\is-BFDPL.tmp]- [targetUID: 00000000-00002168] "is-V6M76.tmp" has type "ASCII text with no line terminators"- Location: [C:\eBIRForms\savefile\is-V6M76.tmp]- [targetUID: 00000000-00002168] "is-0LPIM.tmp" has type "ASCII text with no line terminators"- Location: [C:\eBIRForms\profile\is-0LPIM.tmp]- [targetUID: 00000000-00002168]52:Tc62,"is-QUVL4.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 (stripped to external PDB) 9 sections" - Location: [C:\eBIRForms\is-QUVL4.tmp] "is-K85SF.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections" - Location: [C:\eBIRForms\is-K85SF.tmp] "is-23TNA.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections" - Location: [C:\eBIRForms\is-23TNA.tmp] "Offline_eBIRForms_Package_v7.9.6.2.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections" - Location: [%TEMP%\is-UB103.tmp\Offline_eBIRForms_Package_v7.9.6.2.tmp] "is-IP8HT.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 7 sections" - Location: [C:\eBIRForms\is-IP8HT.tmp] "is-FNNUG.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 5 sections" - Location: [C:\eBIRForms\is-FNNUG.tmp] "is-59MSA.tmp" has type "XML 1.0 document Unicode text UTF-8 text" - Location: [C:\eBIRForms\xml\is-59MSA.tmp] "is-86K89.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections" - Location: [C:\eBIRForms\is-86K89.tmp] "is-FM4L1.tmp" has type "XML 1.0 document ASCII text with very long lines (374)" - Location: [C:\eBIRForms\xml\is-FM4L1.tmp] "is-GTMLL.tmp" has type "Unicode text UTF-8 (with BOM) text with very long lines (330) with CRLF line terminators" - Location: [C:\eBIRForms\is-GTMLL.tmp] "is-NDLAD.tmp" has type "XML 1.0 document ASCII text" - Location: [C:\eBIRForms\xml\is-NDLAD.tmp] "is-LKJ17.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 5 sections" - Location: [C:\eBIRForms\is-LKJ17.tmp] "is-193MH.tmp" has type "MSVC program database ver 7.00 512*43 bytes" - Location: [C:\eBIRForms\is-193MH.tmp] "is-KISM1.tmp" has type "XML 1.0 document Unicode text UTF-8 text" - Location: [C:\eBIRForms\xml\is-KISM1.tmp] "is-S4PAS.tmp" has type "HTML document Unicode text UTF-8 text" - Location: [C:\eBIRForms\xml\is-S4PAS.tmp] "is-IBS1D.tmp" has type "Unicode text UTF-8 text with very long lines (584)" - Location: [C:\eBIRForms\xml\is-IBS1D.tmp] "is-52N0T.tmp" has type "XML 1.0 document ASCII text" - Location: [C:\eBIRForms\xml\is-52N0T.tmp] "is-ACU01.tmp" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections" - Location: [C:\eBIRForms\is-ACU01.tmp] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections" - Location: [%TEMP%\is-C7QRN.tmp\_isetup\_setup64.tmp] "is-LPC43.tmp" has type "XML 1.0 document ASCII text" - Location: [C:\eBIRForms\xml\is-LPC43.tmp] "is-K9DG5.tmp" has type "XML 1.0 document ASCII text" - Location: [C:\eBIRForms\xml\is-K9DG5.tmp] "is-KAPQ9.tmp" has type "XML 1.0 document ASCII text" - Location: [C:\eBIRForms\xml\is-KAPQ9.tmp] "is-U6HB2.tmp" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text" - Location: [C:\eBIRForms\is-U6HB2.tmp] "is-BFDPL.tmp" has type "ASCII text" - Location: [C:\eBIRForms\is-BFDPL.tmp] "is-V6M76.tmp" has type "ASCII text with no line terminators" - Location: [C:\eBIRForms\savefile\is-V6M76.tmp]53:T6e9,"Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")54:Tdcf,"Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "OFFLINE_EBIRFORMS_PACKAGE_V7.9.6.2.EXE"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "OFFLINE_EBIRFORMS_PACKAGE_V7.9.6.2"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "Offline_eBIRForms_Package_v7.9.6.2.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")55:T49a,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size56:T4ee,"Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\OFFLINE_EBIRFORMS_PACKAGE_V7.9.6.2.EXE.LOCAL" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\Offline_eBIRForms_Package_v7.9.6.2.exe.Local\" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "\Device\CNG" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to touch file "C:\WINDOWS\SysWOW64\kernelbase.dll"57:T4a2,"Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBIRForms\EBIRFORMS.LNK" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBIRForms\eBIRForms.lnk" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBIRForms\UNINSTALL.LNK" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access LNK file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBIRForms\Uninstall.lnk" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\eBIRForms\EBIRFORMS.LNK" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\eBIRForms\eBIRForms.lnk" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\eBIRForms\UNINSTALL.LNK" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access LNK file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\eBIRForms\Uninstall.lnk"58:Ta9c,"Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\MSVCP140.dll" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\MPR.DLL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\mpr.dll" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\VERSION.DLL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\version.dll" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\MSIMG32.DLL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\msimg32.dll" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\FLTLIB.DLL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\MSVCP140.DLL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\MSVCP140.dll" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\VCRUNTIME140.DLL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\VCRUNTIME140.dll" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\CRYPTSP.DLL"59:T66e,"Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\OFFLINE_EBIRFORMS_PACKAGE_V7.9.6.2.EXE.LOCAL" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\Offline_eBIRForms_Package_v7.9.6.2.exe.Local\" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-UB103.TMP" "Offline_eBIRForms_Package_v7.9.6.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\OFFLINE_EBIRFORMS_PACKAGE_V7.9.6.2.TMP.LOCAL" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\Offline_eBIRForms_Package_v7.9.6.2.tmp.Local\" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-C7QRN.TMP" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-C7QRN.tmp" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "A:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "B:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "D:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "E:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" trying to access non-existent file "F:"5a:T774,Found reference to API "WNetOpenEnumA" (Indicator: "WNetOpenEnum"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResource"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetGetUniversalNameA" (Indicator: "WNetGetUniversalName"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetGetConnectionA" (Indicator: "WNetGetConnection"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetOpenEnumA" (Indicator: "WNetOpenEnum"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "WNetGetUniversalNameA" (Indicator: "WNetGetUniversalName"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "WNetGetConnectionA" (Indicator: "WNetGetConnection"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResource"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp")5b:T46e,Found reference to API "WNetEnumResourceA" (Indicator: "NetEnumResource"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetGetConnectionA" (Indicator: "NetGetConnection"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "WNetGetConnectionA" (Indicator: "NetGetConnection"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "WNetEnumResourceA" (Indicator: "NetEnumResource"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp")5c:Tfa4,Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://schemas.microsoft.com/smi/2" Heuristic match: "/y.pf" Heuristic match: "ur.dk" Heuristic match: "v6[|.us" Heuristic match: "?z.hn" Heuristic match: "v3`.bn" Heuristic match: ",-.ga" Pattern match: "program.cs/linkinfo/names/src/headerblock/src/files/c:\users\carlo.delacruz\documents\visual" Heuristic match: "command.com" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Heuristic match: "sets or retrieves which panel is currently active in the pen input panel.wf" Heuristic match: "specifies the stroke or collection of strokes to remove from the given collection of strokes.ws" Heuristic match: "provides the best tradeoff between save-time and storage for the typical application.ws" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?linkid=215117" Pattern match: "http://go.microsoft.com/fwlink/?linkid=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://www.msn.com/favicon.ico" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "www.onet[1].xml" Heuristic match: "font.name" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "winscp.net/schema/session/1.0" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0=" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "https://winscp.net/eng/docs/library" Heuristic match: "h;.ms"5d:T240a,Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "https://www.msn.com/favicon.icoc:\windows\system32\usercpl.dll" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002168.00000001.271789.02AC0000.00000004.mdmp") Found URL "https://npcap.com/0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0=604020)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0@ay" - Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found URL "https://winscp.net/eng/docs/library" - Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "https://www.msn.com/favicon.icoc:\windows\system32\usercpl.dll" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00002168.00000002.272832.02AFA000.00000004.mdmp") Found URL "https://npcap.com/d__80" (Indicator: "winscp"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found string "WinSCP.ISessionEvents" (Indicator: "winscp"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found string "c:\misto\wscpblda\build\dotnet\obj\Release\netstandard2.0\WinSCPnet.pdb" (Indicator: "winscp"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found string "$https://winscp.net/eng/docs/library 0" (Indicator: "winscp"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp")5f:Taea,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00002168.00000001.271789.731B1000.00000020.mdmp")60:Tccf,Found registry query API: "RegQueryValueExA" in file "Offline_eBIRForms_Package_v7.9.6.2.exe" Found registry query API: "RegOpenKeyExA" in file "Offline_eBIRForms_Package_v7.9.6.2.exe" Found registry query API: "RegOpenKeyEx" in file "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry query API: "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" in file "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry query API: "RegQueryInfoKeyA" in file "Offline_eBIRForms_Package_v7.9.6.2.exe" Found registry query API: "RegEnumKeyExA" in file "Offline_eBIRForms_Package_v7.9.6.2.exe" Found registry query API: "RegEnumValueA" in file "Offline_eBIRForms_Package_v7.9.6.2.exe" Found registry query API: "RegQueryValueExA" in "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002168.00000000.269871.73217000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002168.00000000.269871.73217000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00002168.00000000.269871.73217000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00002168.00000000.269871.73217000.00000002.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry query API: "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" in "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00002168.00000002.272832.004A3000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp"61:Taa0,Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "0240321562,2408,104,,GetKeyState,user32.dll,"01:10:45.484",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "0288062412,2408,104,,GetKeyState,user32.dll,"01:10:45.500",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "0264374209,2408,104,,GetKeyState,user32.dll,"01:10:45.484",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "21988481651,2408,104,,GetKeyState,user32.dll,"01:11:02.875",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "10502241005,2408,104,,GetKeyState,user32.dll,"01:10:58.093",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "21945306557,2408,104,,GetKeyState,user32.dll,"01:11:02.859",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "13816077225,2408,104,,GetKeyState,user32.dll,"01:10:59.468",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp")62:T55c,Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp")63:T442,"Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "A:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "B:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "D:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "E:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "F:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "G:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "H:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "I:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "J:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "K:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "L:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "M:" "Offline_eBIRForms_Package_v7.9.6.2.tmp" tries to directly access volume data "N:"64:T8ca,"Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter %TEMP%\is-UB103.tmp\Offline_eBIRForms_Package_v7.9.6.2.tmp (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\temp\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\success\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\failed\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\IAF_RDO_Copy\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\IAF_RDC_Copy\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\IAF_Proj_Copy\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\IAF_RDO_Archive\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\IAF_RDC_Archive\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\IAF_Proj_Archive\readme.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\Release Notes 7.9.6.2.txt (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\ebfSFTP.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\ebfSFTP.exe.config (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\ebfSFTP.pdb (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\WinSCP.exe (UID: 00000000-00002168) "Offline_eBIRForms_Package_v7.9.6.2.tmp" called "FindFirstFileA" with parameter C:\eBIRForms\WinSCPnet.dll (UID: 00000000-00002168)65:Tcae,Found string "nAEsD-" (Indicator: "aes"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") file/memory contains long string with (Indicator: "base64"; File: "is-FNNUG.tmp") file/memory contains long string with (Indicator: "blowfish"; File: "is-FNNUG.tmp") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "is-193MH.tmp") file/memory contains long string with (Indicator: "base64"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "createdecryptor"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "createencryptor"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "cryptostream"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "cryptostreammode"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "FromBase64String"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "ToBase64String"; File: "is-ACU01.tmp") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "is-ACU01.tmp") Found string "IPF_Base64InkSerializedFormatWWW" (Indicator: "base64"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found string "IPF_Base64GIFWWWh" (Indicator: "base64"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found string "Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi" (Indicator: "base64"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found string "Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1" (Indicator: "base64"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002168.00000001.271789.05F30000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00002168.00000001.271789.05F30000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00002168.00000001.271789.05F30000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002168.00000001.271789.05F30000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00002168.00000001.271789.05F90000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00002168.00000001.271789.05F90000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002168.00000001.271789.05F90000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00002168.00000001.271789.05F90000.00000002.mdmp") Found string "(ssh-rsa|ssh-dss|ssh-ed25519|ecdsa-sha2-nistp(256|384|521))( |-))?(\d+ )?(([0-9a-fA-F]{2}(:|-)){15}[0-9a-fA-F]{2}|[0-9a-zA-Z+/\-_]{43}=?)" (Indicator: "ecdsa"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002168.00000002.272832.0092B000.00000004.mdmp")66:T533,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "21968549417,2408,3119,,FindNextFileA,kernel32.dll,"01:11:02.859",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "21971544029,2408,3119,,FindNextFileA,kernel32.dll,"01:11:02.859",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "21967022451,2408,3117,,FindFirstFileA,kernel32.dll,"01:11:02.859",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp")67:T7e1,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0092B000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")68:T1219,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")69:T52e,Found string "Where should eBIRForms be installed?" (Indicator: "where "; Source: "00000000-00002168-00000455-19738539451") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00002168-00000455-75897156796") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00002168.00000000.269871.04C48000.00000004.mdmp, 00000000-00002168.00000001.271789.04C48000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00002168.00000000.269871.04C48000.00000004.mdmp, 00000000-00002168.00000001.271789.04C48000.00000004.mdmp") Found string "Where should eBIRForms be installed?" (Indicator: "where "; Source: "00000000-00002168.00000000.269871.04C60000.00000004.mdmp, 00000000-00002168.00000001.271789.04C60000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts@" (Indicator: "where "; Source: "00000000-00002168.00000001.271789.04C60000.00000004.mdmp") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00002600.00000000.269773.04990000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00002600.00000000.269773.04990000.00000004.mdmp")6a:Ta4f,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "6301446245,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.843",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6033678309,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.718",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6601899901,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.968",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6151143473,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.781",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6451866033,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.906",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6304578979,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.843",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6451288475,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.906",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6452697567,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.906",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6600953309,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.968",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "6302172547,2408,111,,GetSystemMetrics,user32.dll,"01:10:43.843",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000001.271789.02B73000.00000004.mdmp") Found reference to API "21990130851,2408,111,,GetSystemMetrics,user32.dll,"01:11:02.875",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp")6b:T75a,Found string "asks will be merged with the set of tasks that would have otherwise been selected by default./PASSWORD=passwordSpecifies the password to use.For more detailed information, please visit http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" (Indicator: "password"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") file/memory contains long string with (Indicator: "password"; File: "is-193MH.tmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00002168.00000000.269871.04C48000.00000004.mdmp, 00000000-00002168.00000001.271789.04C48000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00002168.00000000.269871.04C48000.00000004.mdmp, 00000000-00002168.00000001.271789.04C48000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00002168.00000000.269871.04C48000.00000004.mdmp, 00000000-00002168.00000001.271789.04C48000.00000004.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00002600.00000000.269773.04990000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00002600.00000000.269773.04990000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00002600.00000000.269773.04990000.00000004.mdmp") Found string "/PASSWORD=password" (Indicator: "password"; Source: "00000000-00002600.00000001.271690.00401000.00000020.mdmp") Found string "Specifies the password to use." (Indicator: "password"; Source: "00000000-00002600.00000001.271690.00401000.00000020.mdmp")6c:T502,"Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 5682-690-0047A0E0 "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 5682-769-00473FD0 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 5682-3050-0046FE70 "oftware\Microsoft\Windows\CurrentVersion\Uninstall\eBIRForms_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002168.00000000.269871.02AC0000.00000004.mdmp 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp 00000000-00002168.00000002.272832.02AE3000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002168.00000002.272832.00401000.00000020.mdmp6d:T7e8,Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in file "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in file "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyA" in file "Offline_eBIRForms_Package_v7.9.6.2.exe" Found registry deletion API: "RegDeleteValueA" in file "Offline_eBIRForms_Package_v7.9.6.2.exe" Found registry deletion API: "RegDeleteValueA" in "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00002168.00000000.269871.73217000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00002168.00000001.271789.731B1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00002168.00000001.271789.731B1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExA" in "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00002168.00000002.272832.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in "00000000-00002168.00000002.272832.00401000.00000020.mdmp"6e:Tb94,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "21973099121,2408,3136,,RemoveDirectoryA,kernel32.dll,"01:11:02.859",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "21972249283,2408,3136,,RemoveDirectoryA,kernel32.dll,"01:11:02.859",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")6f:T68c,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp")70:T707,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002600.00000001.271690.00401000.00000020.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")71:T49c,Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "10448887756,2408,113,,SystemParametersInfoW,user32.dll,"01:10:58.062",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "21938129298,2408,113,,SystemParametersInfoW,user32.dll,"01:11:02.859",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp") Found reference to API "21906484636,2408,113,,SystemParametersInfoW,user32.dll,"01:11:02.843",RX=0,PX=0" (Indicator: "SystemParametersInfo"; Source: "00000000-00002168.00000002.272832.02B73000.00000004.mdmp")72:Tf54,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00002168.00000002.272832.00401000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00002168.00000002.272832.004A3000.00000002.mdmp")73:T419,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp")74:T16f4,"Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "7808000041BD9DDF8D53DD0100") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "3D95368254A6362A035F3EB8D6467CC207D506BB028B4059E0A85A5AB165E46900") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "C:\eBIRForms\BIRForms.exe") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "158713F8578A14EC6BCDBE3762258307AB26512D85F2D5F146B383D948C645CD00") "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "INNO SETUP: SETUP VERSION"; Value: "5.5.9 (a)"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "INNO SETUP: APP PATH"; Value: "C:\eBIRForms"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "INSTALLLOCATION"; Value: "C:\eBIRForms\"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "INNO SETUP: ICON GROUP"; Value: "eBIRForms"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "INNO SETUP: USER"; Value: "DFXgGN9"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "INNO SETUP: LANGUAGE"; Value: "default"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "DISPLAYNAME"; Value: "eBIRForms version v7.9.6.2"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "UNINSTALLSTRING"; Value: ""C:\eBIRForms\unins000.exe""), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "QUIETUNINSTALLSTRING"; Value: ""C:\eBIRForms\unins000.exe" /SILENT"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "DISPLAYVERSION"; Value: "v7.9.6.2"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "NOMODIFY"; Value: "0100000000"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "NOREPAIR"; Value: "0100000000"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "INSTALLDATE"; Value: "20261003"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EBIRFORMS_IS1"; Key: "ESTIMATEDSIZE"; Value: "ED43010000"), "Offline_eBIRForms_Package_v7.9.6.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "6E22000000000000040004000100010001010000F1D9A3007900020000000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B0021777A00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB5006041AE00682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E0078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE0087DE83008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BCFA8D00BD539800BE0CAC00C0CC9900C36D8100C4114C00C8464E00C9389700CA23B700CC495600CDBD8C00CFC29400D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EBBF8400EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C005A000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A004293800042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC00508FC4005CE17D00624F980066E7820069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000400400100000571AE006041AE00682C9000F1D9A300010043010000C0EC7C0000")75:T624,Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "Offline_eBIRForms_Package_v7.9.6.2.exe") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00002168.00000000.269871.73217000.00000002.mdmp") Found reference to API "procedure CreateMutex(const Name: String);" (Indicator: "CreateMutex"; Source: "00000000-00002168.00000002.272832.00401000.00000020.mdmp")76:T724,"is-QUVL4.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 (stripped to external PDB) 9 sections"- Location: [C:\eBIRForms\is-QUVL4.tmp]- [targetUID: 00000000-00002168] "is-K85SF.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [C:\eBIRForms\is-K85SF.tmp]- [targetUID: 00000000-00002168] "is-23TNA.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [C:\eBIRForms\is-23TNA.tmp]- [targetUID: 00000000-00002168] "Offline_eBIRForms_Package_v7.9.6.2.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-UB103.tmp\Offline_eBIRForms_Package_v7.9.6.2.tmp]- [targetUID: 00000000-00002600] "is-IP8HT.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 7 sections"- Location: [C:\eBIRForms\is-IP8HT.tmp]- [targetUID: 00000000-00002168] "is-FNNUG.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 5 sections"- Location: [C:\eBIRForms\is-FNNUG.tmp]- [targetUID: 00000000-00002168] "is-86K89.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- Location: [C:\eBIRForms\is-86K89.tmp]- [targetUID: 00000000-00002168] "is-LKJ17.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 5 sections"- Location: [C:\eBIRForms\is-LKJ17.tmp]- [targetUID: 00000000-00002168] "is-ACU01.tmp" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [C:\eBIRForms\is-ACU01.tmp]- [targetUID: 00000000-00002168] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-C7QRN.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002168]77:T810,"Offline_eBIRForms_Package_v7.9.6.2.exe" wrote 58368 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-UB103.tmp\Offline_eBIRForms_Package_v7.9.6.2.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "Offline_eBIRForms_Package_v7.9.6.2.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-C7QRN.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Offline_eBIRForms_Package_v7.9.6.2.tmp" wrote 16384 bytes starting with PE header signature to file "C:\eBIRForms\is-23TNA.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "Offline_eBIRForms_Package_v7.9.6.2.tmp" wrote 38400 bytes starting with PE header signature to file "C:\eBIRForms\is-LKJ17.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Offline_eBIRForms_Package_v7.9.6.2.tmp" wrote 9216 bytes starting with PE header signature to file "C:\eBIRForms\is-ACU01.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...78:T400,AAABAAEAICAQOgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":75,"unified_at_epoch_ms":1791270213665,"unified_at":"2026-10-06T07:03:33.665Z","metadata":{"hashes":{"sha256":"2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","sha1":"0cc6ef26a2e8ab5a7e2f275a0d02dd2e1dc0615b","md5":"7e5de0e176f2c50bdcf0b842d2e8b7cb","sha512":"e305cc7f1947e5c1ff64c14eb11c0a580fb8c38163c41e92065fea146cc2afc45900c80cf86ffaa34bdf7f1d8ea8d77acc79a892dc9a0f3d7ebc88bb4ea56dc7","ssdeep":"393216:x4LIkDPGychzEAUVo5Tu2g1LtO2O6J8glSNcPirPOt6kaG1X3j0GfhAT6CNgH:m9DPqE/Vo5T+xOCHletr2ttb1X3AGM8","ssdeep_chunks":["393216:x4LIkDP","393216:4LIkDPG","393216:LIkDPGy","393216:IkDPGyc","393216:kDPGych","393216:DPGychz","393216:PGychzE","393216:GychzEA","393216:ychzEAU","393216:chzEAUV","393216:hzEAUVo","393216:zEAUVo5","393216:EAUVo5T","393216:AUVo5Tu","393216:UVo5Tu2","393216:Vo5Tu2g","393216:o5Tu2g1","393216:5Tu2g1L","393216:Tu2g1Lt","393216:u2g1LtO","393216:2g1LtO2","393216:g1LtO2O","393216:1LtO2O6","393216:LtO2O6J","393216:tO2O6J8","393216:O2O6J8g","393216:2O6J8gl","393216:O6J8glS","393216:6J8glSN","393216:J8glSNc","393216:8glSNcP","393216:glSNcPi","393216:lSNcPir","393216:SNcPirP","393216:NcPirPO","393216:cPirPOt","393216:PirPOt6","393216:irPOt6k","393216:rPOt6ka","393216:POt6kaG","393216:Ot6kaG1","393216:t6kaG1X","393216:6kaG1X3","393216:kaG1X3j","393216:aG1X3j0","393216:G1X3j0G","393216:1X3j0Gf","393216:X3j0Gfh","393216:3j0GfhA","393216:j0GfhAT","393216:0GfhAT6","393216:GfhAT6C","393216:fhAT6CN","393216:hAT6CNg","393216:AT6CNgH","786432:x4LIkDP","786432:4LIkDPG","786432:LIkDPGy","786432:IkDPGyc","786432:kDPGych","786432:DPGychz","786432:PGychzE","786432:GychzEA","786432:ychzEAU","786432:chzEAUV","786432:hzEAUVo","786432:zEAUVo5","786432:EAUVo5T","786432:AUVo5Tu","786432:UVo5Tu2","786432:Vo5Tu2g","786432:o5Tu2g1","786432:5Tu2g1L","786432:Tu2g1Lt","786432:u2g1LtO","786432:2g1LtO2","786432:g1LtO2O","786432:1LtO2O6","786432:LtO2O6J","786432:tO2O6J8","786432:O2O6J8g","786432:2O6J8gl","786432:O6J8glS","786432:6J8glSN","786432:J8glSNc","786432:8glSNcP","786432:glSNcPi","786432:lSNcPir","786432:SNcPirP","786432:NcPirPO","786432:cPirPOt","786432:PirPOt6","786432:irPOt6k","786432:rPOt6ka","786432:POt6kaG","786432:Ot6kaG1","786432:t6kaG1X","786432:6kaG1X3","786432:kaG1X3j","786432:aG1X3j0","786432:G1X3j0G","786432:1X3j0Gf","786432:X3j0Gfh","786432:3j0GfhA","786432:j0GfhAT","786432:0GfhAT6","786432:GfhAT6C","786432:fhAT6CN","786432:hAT6CNg","786432:AT6CNgH","393216:m9DPqE/","393216:9DPqE/V","393216:DPqE/Vo","393216:PqE/Vo5","393216:qE/Vo5T","393216:E/Vo5T+","393216:/Vo5T+x","393216:Vo5T+xO","393216:o5T+xOC","393216:5T+xOCH","393216:T+xOCHl","393216:+xOCHle","393216:xOCHlet","393216:OCHletr","393216:CHletr2","393216:Hletr2t","393216:letr2tt","393216:etr2ttb","393216:tr2ttb1","393216:r2ttb1X","393216:2ttb1X3","393216:ttb1X3A","393216:tb1X3AG","393216:b1X3AGM","393216:1X3AGM8"],"imphash":"2fb819a19fe4dee5c03e8c6a79342f79","pehash":"60365132280c2f6bc90bbf50138b1936ce87e357"},"file_info":{"file_name":"Offline_eBIRForms_Package_v7.9.6.2.exe","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":18530332,"entropy":8,"compile_timestamp":"1992-06-19T22:22:17","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791069647000,"last_seen":1791265797000,"last_multi_scan":1791265797000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":"CODE","virtual_address":"0x1000","virtual_size":41424,"raw_size":41472},{"name":"DATA","virtual_address":"0xc000","virtual_size":592,"raw_size":1024},{"name":"BSS","virtual_address":"0xd000","virtual_size":3732},{"name":".idata","virtual_address":"0xe000","virtual_size":2428,"raw_size":2560},{"name":".tls","virtual_address":"0xf000","virtual_size":8},{"name":".rdata","virtual_address":"0x10000","virtual_size":24,"raw_size":512},{"name":".reloc","virtual_address":"0x11000","virtual_size":2332},{"name":".rsrc","virtual_address":"0x12000","virtual_size":11264,"raw_size":11264}],"section_names":["CODE","DATA","BSS",".idata",".tls",".rdata",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":75,"tags":["agent","filetour","adinstaller","adware","evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":210,"suspicious_count":13,"malicious_count":1,"total":224},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Immirat.B.zvol","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Immirat.B","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops XML files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"FindResourceA\" with parameter \"11111\" - (UID: 00000000-00002600)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"FindResourceA\" with parameter \"4557880\" - (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"FindResourceA\" with parameter \"80095992\" - (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"FindResourceA\" with parameter \"80097232\" - (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"FindResourceA\" with parameter \"80109040\" - (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4268800'}\" (UID: 00000000-00002600)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4905256'}\" (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4905288'}\" (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4905384'}\" (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4905320'}\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-UB103.tmp (UID: 00000000-00002600)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-C7QRN.tmp\\_isetup (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-C7QRN.tmp (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Offline_eBIRForms_Package_v7.9.6.2.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2b","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"$2c","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"is-ACU01.tmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"is-ACU01.tmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002168.00000000.269871.02AC0000.00000004.mdmp, 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp, 00000000-00002168.00000002.272832.02AC0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002600.00000001.271690.02BD0000.00000004.mdmp, 00000000-00002600.00000002.272838.02BD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"Bc:\\program files\\oracle\\virtualbox guest additions\\vboxdrvinst.exe\" (Source: \"00000000-00002168.00000001.271789.02AC0000.00000004.mdmp, 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp\")\n Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Source: \"00000000-00002168.00000001.271789.02AC0000.00000004.mdmp, 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"is-86K89.tmp\")\n file/memory contains long string(File: \"is-ACU01.tmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002168.00000001.271789.02AC0000.00000004.mdmp, 00000000-00002168.00000002.272832.02AFA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"unins000.dat\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002168.00000000.269871.73217000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"file/memory contains long string with (Indicator: \"getlastwritetime\"; File: \"is-86K89.tmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002600)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002600)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetMonitorInfoA\" with parameters (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"IsWow64Process\" with parameter \"2168\" - (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"EnumWindows\" with parameter \"9695264\" - (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"EnumWindows\" with parameter \"9695168\" - (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"EnumWindows\" with parameter \"9695176\" - (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"EnumWindows\" with parameter \"9697560\" - (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$36","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetActiveWindow\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002600)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002600)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-6-0047E0A8\n GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-697-0042F2D4\n GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-700-0042F2BC\n GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-722-00458DC4\n GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-3036-00478EB4\n GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-3096-0048483C\n GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-3431-00498914\n GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-4443-0047E054\n GetTickCount@KERNEL32.DLL at 00000000-00002168-5682-4583-00497B28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileA@KERNEL32.DLL at 00000000-00002168-5682-84-00454868\n FindFirstFileA@KERNEL32.DLL at 00000000-00002168-5682-97-004531A4\n FindNextFileA@KERNEL32.DLL at 00000000-00002168-5682-649-00481008\n FindNextFileA@KERNEL32.DLL at 00000000-00002168-5682-784-004730AC\n FindNextFileA@KERNEL32.DLL at 00000000-00002168-5682-2716-00454B5C\n FindFirstFileA@KERNEL32.DLL at 00000000-00002168-5682-2868-00463344\n FindFirstFileA@KERNEL32.DLL at 00000000-00002168-5682-2906-004648D0\n FindFirstFileA@KERNEL32.DLL at 00000000-00002168-5682-2914-00464D4C\n FindNextFileA@KERNEL32.DLL at 00000000-00002168-5682-3002-0047E980\n FindFirstFileA@KERNEL32.DLL at 00000000-00002168-5682-3075-00476120\n FindFirstFileA@KERNEL32.DLL at 00000000-00002168-5682-3435-0049998C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00002168-5682-2904-004647E8\n GetDriveTypeA@KERNEL32.DLL at 00000000-00002168-5682-2912-00464BF4\n GetDriveTypeA@KERNEL32.DLL at 00000000-00002168-5682-3020-0046D17C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002168-5682-78-00458208\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002168-5682-722-00458DC4\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00002168-5682-801-0046F428\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002168-5682-2761-004581C4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00000000-00002600-3777-114-0040102C\n GetSystemTime@KERNEL32.DLL at 00000000-00002600-3777-150-004026C4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002168-5682-78-00458208\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002168-5682-722-00458DC4\n GetSystemTime@KERNEL32.DLL at 00000000-00002168-5682-1941-00402778\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002168-5682-2761-004581C4\n GetLocalTime@KERNEL32.DLL at 00000000-00002168-5682-3048-0046F754\n GetLocalTime@KERNEL32.DLL at 00000000-00002168-5682-3055-0046FD00\n GetLocalTime@KERNEL32.DLL at 00000000-00002168-5682-3378-004081F8\n GetLocalTime@KERNEL32.DLL at 00000000-00002168-5682-3379-004081CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$39","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002600-3777-162-0040565C\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002600-3777-168-004056A8\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002168-5682-1962-004089B8\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002168-5682-1966-00408A04","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00002168-5682-2737-004565A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Offline_eBIRForms_Package_v7.9.6.2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00002600-3777-287-0040A018\n GetSystemInfo@KERNEL32.DLL at 00000000-00002168-5682-3200-00484E68","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00002600-3777-213-004074A0\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00002600-3777-264-004099DC\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00002168-5682-2432-0042E868\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00002168-5682-2741-00456890","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00002600-3777-418-004043A2\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002168-5682-644-00455D80\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002168-5682-2430-0042E4EC\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002168-5682-3174-0047944C\n OpenProcess@KERNEL32.DLL at 00000000-00002168-5682-3418-00497DDC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$3d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002168-00000C17-3096243686\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002168-00000C17-3096383027","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EBIRFORMS_IS1\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EBIRFORMS_IS1\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OFFLINE_EBIRFORMS_PACKAGE_V7.9.6.2.TMP\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"Offline_eBIRForms_Package_v7.9.6.2.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002168.00000000.269871.73217000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"is-86K89.tmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"is-K85SF.tmp\")\n file/memory contains long string(File: \"is-LKJ17.tmp\")\n file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002168.00000000.269871.73217000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp\" /SL5=\"$401CA\n18283059\n57856\nC:\\Offline_eBIRForms_Package_v7.9.6.2.exe\"\" - (UID: 00000000-00002600)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shell32.dll (UID: 00000000-00002600)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\uxtheme.dll (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shell32.dll (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shfolder.dll (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\Rstrtmgr.dll (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shlwapi.dll (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\sfc.dll (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$3f","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$40","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00002168.00000002.272832.0092B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002168.00000002.272832.0092B000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00000000-00002168-5682-722-00458DC4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$42","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002600-3777-156-004045CC\n LoadLibraryA@KERNEL32.DLL at 00000000-00002600-3777-212-0040741C\n LoadLibraryA@KERNEL32.DLL at 00000000-00002168-5682-390-0042E7E4\n LoadLibraryExA@KERNEL32.DLL at 00000000-00002168-5682-1175-004489CC\n LoadLibraryA@KERNEL32.DLL at 00000000-00002168-5682-1948-0040636C\n LoadLibraryA@KERNEL32.DLL at 00000000-00002168-5682-2595-0044BB28\n LoadLibraryA@KERNEL32.DLL at 00000000-00002168-5682-2597-0044CD48\n LoadLibraryA@KERNEL32.DLL at 00000000-00002168-5682-2678-00450390\n LoadLibraryA@KERNEL32.DLL at 00000000-00002168-5682-2684-00450994\n LoadLibraryA@KERNEL32.DLL at 00000000-00002168-5682-2918-00465214\n LoadLibraryA@KERNEL32.DLL at 00000000-00002168-5682-3458-0041F568","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4a","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$4b","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"is-23TNA.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"is-86K89.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"is-ACU01.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74820000\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74820000\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73270000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74390000\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74390000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4e","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (UID: 00000000-00002168) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (UID: 00000000-00002168) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Offline_eBIRForms_Package_v7.9.6.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Offline_eBIRForms_Package_v7.9.6.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00002600-00000C2B-3052013054]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00002168-00000C2B-3052919737]\n Observed system executable string:\"%WINDIR%\\system32\\shfolder.dll\" [Source: 00000000-00002168-00000C2B-3053035529]\n Observed system executable string:\"%WINDIR%\\system32\\Rstrtmgr.dll\" [Source: 00000000-00002168-00000C2B-3053057696]\n Observed system executable string:\"%WINDIR%\\system32\\shlwapi.dll\" [Source: 00000000-00002168-00000C2B-3053279721]\n Observed system executable string:\"%WINDIR%\\system32\\sfc.dll\" [Source: 00000000-00002168-00000C2B-3092785339]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" with commandline \"/SL5=\"$401CA\n18283059\n57856\nC:\\\\Offline_eBIRForms_Package_v7.9.6 ...\" (UID: 00000000-00002168)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" with commandline \"/SL5=\"$401CA\n18283059\n57856\nC:\\\\Offline_eBIRForms_Package_v7.9.6 ...\" (UID: 00000000-00002168)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-23TNA.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-IP8HT.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-FNNUG.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-LKJ17.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-C7QRN.tmp\\_isetup\\_setup64.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" with commandline \"/SL5=\"$401CA\n18283059\n57856\nC:\\\\Offline_eBIRForms_Package_v7.9.6.2.exe\"\" (UID: 00000000-00002168)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00002168-5682-593-00455D38","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$51","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"is-59MSA.tmp\" has type \"XML 1.0 document Unicode text UTF-8 text\" - Location: [C:\\eBIRForms\\xml\\is-59MSA.tmp]\n \"is-FM4L1.tmp\" has type \"XML 1.0 document ASCII text with very long lines (374)\" - Location: [C:\\eBIRForms\\xml\\is-FM4L1.tmp]\n \"is-NDLAD.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [C:\\eBIRForms\\xml\\is-NDLAD.tmp]\n \"is-KISM1.tmp\" has type \"XML 1.0 document Unicode text UTF-8 text\" - Location: [C:\\eBIRForms\\xml\\is-KISM1.tmp]\n \"is-52N0T.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [C:\\eBIRForms\\xml\\is-52N0T.tmp]\n \"is-LPC43.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [C:\\eBIRForms\\xml\\is-LPC43.tmp]\n \"is-K9DG5.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [C:\\eBIRForms\\xml\\is-K9DG5.tmp]\n \"is-KAPQ9.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [C:\\eBIRForms\\xml\\is-KAPQ9.tmp]\n \"is-U6HB2.tmp\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text\" - Location: [C:\\eBIRForms\\is-U6HB2.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$52","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp\" (UID: 2600)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp\" (UID: 2168)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$54","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" reads file \"c:\\offline_ebirforms_package_v7.9.6.2.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$55","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Explorer\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\eBIRForms\\eBIRForms.lnk\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\eBIRForms\\Uninstall.lnk\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\eBIRForms\\eBIRForms.lnk\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\eBIRForms\\Uninstall.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-ub103.tmp\\offline_ebirforms_package_v7.9.6.2.tmp\"\n \"Offline_eBIRForms_Package_v7.9.6.2.exe\" writes file \"%temp%\\is-ub103.tmp\\offline_ebirforms_package_v7.9.6.2.tmp\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-c7qrn.tmp\\_isetup\\_setup64.tmp\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" writes file \"c:\\ebirforms\\is-23tna.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" writes a file \"C:\\eBIRForms\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" socket \"; File: \"is-FNNUG.tmp\")\n Found reference to API \"User chose not to shutdown applications using our files.\" (Indicator: \" shutdown \"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"User chose not to shutdown applications using our files.\" (Indicator: \" shutdown \"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"Duplicate CardId found\"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)\"Unable to connect DDE conversation\" (Indicator: \" connect \"; Source: \"00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.1.32.0\"\n \"17.005.0107.0008\"\n \"2.13.0.0\"\n \"3.3.14.3\"\n \"2.53.0.0\"\n \"5.2.24.0\"\n \"51.52.0.0\"\n \"6.5.5.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"is-IP8HT.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"is-86K89.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002168.00000000.269871.04C48000.00000004.mdmp, 00000000-00002168.00000001.271789.04C48000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00002600-3777-248-00409428\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002600-3777-249-004093EC\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002600-3777-252-00409520\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00002168-5682-91-00452EA4\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002168-5682-92-00452E68\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002168-5682-2706-00453934","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00002600.00000001.271690.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00002600.00000001.271690.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"is-86K89.tmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"$63","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$64","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetComputerNameA\" (UID: 00000000-00002168)\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetComputerNameW\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" called \"GetUserNameA\" (UID: 00000000-00002168)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$65","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002168.00000000.269871.73217000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002168.00000000.269871.73217000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.00401000.00000020.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$69","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002168.00000000.269871.73217000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000000.269871.73217000.00000002.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002168.00000000.269871.73217000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002168.00000000.269871.73217000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002168.00000001.271789.731B1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00002168.00000002.272832.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002168.00000000.269871.02AC0000.00000004.mdmp, 00000000-00002168.00000001.271789.02AC0000.00000004.mdmp\")\n Found string \"NDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002168.00000002.272832.02AC0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002168.00000002.272832.02B73000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002600.00000001.271690.02BD0000.00000004.mdmp, 00000000-00002600.00000002.272838.02BD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.004A3000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\TEMP\\IS-UB103.TMP\\OFFLINE_EBIRFORMS_PACKAGE_V7.9.6.2.TMP\"; Value: \"\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$74","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"Offline_eBIRForms_Package_v7.9.6.2.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002168.00000000.269871.0049D000.00000004.mdmp, 00000000-00002168.00000001.271789.0049D000.00000004.mdmp, 00000000-00002168.00000002.272832.0049D000.00000004.mdmp\")\n Found reference to API \"ExitWindows\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002168.00000002.272832.0092B000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002600.00000001.271690.0040C000.00000004.mdmp, 00000000-00002600.00000002.272838.0040C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections\"- Location: [%TEMP%\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp]- [targetUID: 00000000-00002600]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-C7QRN.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00002168]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SetDefaultDllDirectories\" (Source: Offline_eBIRForms_Package_v7.9.6.2.exe, API is part of module: KERNELBASE.DLL)\n Found string \"SetDllDirectoryW\" (Source: Offline_eBIRForms_Package_v7.9.6.2.exe, API is part of module: KERNEL32.DLL)\n Found string \"SetSearchPathMode\" (Source: Offline_eBIRForms_Package_v7.9.6.2.exe, API is part of module: KERNEL32.DLL)\n Found string \"SetProcessDEPPolicy\" (Source: Offline_eBIRForms_Package_v7.9.6.2.exe, API is part of module: KERNEL32.DLL)\n Found string \"GetUserDefaultUILanguage\" (Source: Offline_eBIRForms_Package_v7.9.6.2.exe, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64DisableWow64FsRedirection\" (Source: Offline_eBIRForms_Package_v7.9.6.2.exe, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64RevertWow64FsRedirection\" (Source: Offline_eBIRForms_Package_v7.9.6.2.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"REGFILES0000\"; Value: \"C:\\eBIRForms\\BIRForms.exe\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EBIRFORMS_IS1\"; Key: \"UNINSTALLSTRING\"; Value: \"\"C:\\eBIRForms\\unins000.exe\"\")\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EBIRFORMS_IS1\"; Key: \"QUIETUNINSTALLSTRING\"; Value: \"\"C:\\eBIRForms\\unins000.exe\" /SILENT\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00002600-3777-285-0040A0D4\n FindResourceA@KERNEL32.DLL at 00000000-00002168-5682-249-0040B228\n FindResourceA@KERNEL32.DLL at 00000000-00002168-5682-272-0040D460\n FreeResource@KERNEL32.DLL at 00000000-00002168-5682-4738-0040D4CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Offline_eBIRForms_Package_v7.9.6.2.tmp\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$76","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$77","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature match for RMM tool activity (winscp) detected in file \"is-86K89.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1219","relevance":5,"id":"yara-557","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"is-QUVL4.tmp\"\n YARA signature for null IAT Directory of PE file \"sample.bin\"\n YARA signature for invalid Timestamp of PE file \"is-IP8HT.tmp\"\n YARA signature for invalid Timestamp of PE file \"is-FNNUG.tmp\"\n YARA signature for invalid Timestamp of PE file \"is-LKJ17.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00002168-5682-205-00496BDC\n SystemParametersInfoA@USER32.DLL at 00000000-00002168-5682-2353-00423A78\n SystemParametersInfoA@USER32.DLL at 00000000-00002168-5682-2354-00423A48\n SystemParametersInfoA@USER32.DLL at 00000000-00002168-5682-2876-004638CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp\" for deletion\n \"Offline_eBIRForms_Package_v7.9.6.2.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-C7QRN.tmp\\_isetup\\_setup64.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00002168-5682-1775-00405E14\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00002168-5682-2751-00457D90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Offline_eBIRForms_Package_v7.9.6.2.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Handle: 568)\n \"Offline_eBIRForms_Package_v7.9.6.2.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp\" (Handle: 568)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00005192.00000001.231538.00880000.00000004.mdmp, 00000000-00005192.00000002.231728.00940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"update.exe,rundll32.exe,smss.exe,csrss.exe,wininit.exe\" (Source: \"00000000-00005192.00000001.231538.00880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005192.00000001.231538.00880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryA@KERNEL32.DLL at 00000000-00001056-32863-383-0040AFF0\n RemoveDirectoryA@KERNEL32.DLL at 00000000-00005192-34482-90-00453554\n RemoveDirectoryA@KERNEL32.DLL at 00000000-00005192-34482-763-00473950","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Attempts to access unusual system drive letters"},{"detail":"Able to discover network shares"}],"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]}],"intel_graph":{"map":{"File:1186b3a97c2eb73bc60a312a263d04055f383267159b5ac5fcd9debd496d1809":{"type":"File","value":"1186b3a97c2eb73bc60a312a263d04055f383267159b5ac5fcd9debd496d1809"},"File:19c46f63075e1d759cf92575eabee9d40e170098ec9f928ff1e9a3093e620e5a":{"type":"File","value":"19c46f63075e1d759cf92575eabee9d40e170098ec9f928ff1e9a3093e620e5a","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260":{"type":"File","value":"2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},"File:388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95":{"type":"File","value":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95"},"File:429337f44f84b93cd1095df48c8f3265e5ede7c646d1b48d9b80f4f92de74d2c":{"type":"File","value":"429337f44f84b93cd1095df48c8f3265e5ede7c646d1b48d9b80f4f92de74d2c"},"File:4c4b269e4e9b29c2d358a6810adabb47d4b38b08d13707b04e40a87ed5eb97a6":{"type":"File","value":"4c4b269e4e9b29c2d358a6810adabb47d4b38b08d13707b04e40a87ed5eb97a6"},"File:4e41553521bdeab160d5387ae619c713df6699c1b3bb1020fe5b5182caff9bc8":{"type":"File","value":"4e41553521bdeab160d5387ae619c713df6699c1b3bb1020fe5b5182caff9bc8"},"File:5d3dbda56e3ffffefb23f2fd46a5af0c0decc389d70921c453c3f813bb806262":{"type":"File","value":"5d3dbda56e3ffffefb23f2fd46a5af0c0decc389d70921c453c3f813bb806262","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},"File:5fe1ad802f68d7c47dbbd8e60162ba88abaed162da5d381c85d3e4935311962e":{"type":"File","value":"5fe1ad802f68d7c47dbbd8e60162ba88abaed162da5d381c85d3e4935311962e"},"File:67c30aa5adaae81639069cc6bdbc3df12851858af87e146f34da254a90db031c":{"type":"File","value":"67c30aa5adaae81639069cc6bdbc3df12851858af87e146f34da254a90db031c"},"File:8250d630f8326a0865fb29e8a154485d4ce324497055e0028f6f1312d0c8bd77":{"type":"File","value":"8250d630f8326a0865fb29e8a154485d4ce324497055e0028f6f1312d0c8bd77"},"File:95f68e235231a4d426feb84a444c4bdfa0d462826a1dfdd4a1511980c151d916":{"type":"File","value":"95f68e235231a4d426feb84a444c4bdfa0d462826a1dfdd4a1511980c151d916"},"File:9dc36e76e6dc6e0e0e5e09df1b099c118089d1676adaba8e83f1cfd3fda2a782":{"type":"File","value":"9dc36e76e6dc6e0e0e5e09df1b099c118089d1676adaba8e83f1cfd3fda2a782"},"File:9e86e48fb486a3607f6f844e074d6efff939a9370df086dc328bb251b4a0ff7d":{"type":"File","value":"9e86e48fb486a3607f6f844e074d6efff939a9370df086dc328bb251b4a0ff7d"},"File:a7e560d419e85daf80cce980baa124ef7c73197d0f51a59a19f1866ee8edfe8c":{"type":"File","value":"a7e560d419e85daf80cce980baa124ef7c73197d0f51a59a19f1866ee8edfe8c"},"File:bfc220459cc2ee249ca6af4907f4744c5c80c1953dc93442f9eaec77989531fa":{"type":"File","value":"bfc220459cc2ee249ca6af4907f4744c5c80c1953dc93442f9eaec77989531fa"},"File:c00bd4131a725af53f48c6385d3332c4b789e15441bf52bbac73117c96c1b0ac":{"type":"File","value":"c00bd4131a725af53f48c6385d3332c4b789e15441bf52bbac73117c96c1b0ac"},"File:c6ba25014d30a11b97d9d90c3b87f2f0c13d35ef6188ea5c086f48b3933d297f":{"type":"File","value":"c6ba25014d30a11b97d9d90c3b87f2f0c13d35ef6188ea5c086f48b3933d297f"},"File:cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3":{"type":"File","value":"cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3"},"File:d148dc2569e9abc4b4da650b1920ef1ffdc10bbd6bc2e20a97ce44b1f9f78aea":{"type":"File","value":"d148dc2569e9abc4b4da650b1920ef1ffdc10bbd6bc2e20a97ce44b1f9f78aea"},"File:d43bc699be8676880a1b93be0190ccea27fa3ed848a683fa6e571a78dd14f36b":{"type":"File","value":"d43bc699be8676880a1b93be0190ccea27fa3ed848a683fa6e571a78dd14f36b"},"File:dab8f3fe073f157f609ad288b33402ab96e94005d8b56ff0fa3bd8c0c27750d3":{"type":"File","value":"dab8f3fe073f157f609ad288b33402ab96e94005d8b56ff0fa3bd8c0c27750d3"},"File:e6bd718a478c6c3706d3d6ef274ad58f86504383807be4672fa52565e7270627":{"type":"File","value":"e6bd718a478c6c3706d3d6ef274ad58f86504383807be4672fa52565e7270627"},"File:e915bc9cc65f24fea407d95cbf28a9fe0bbee76e91c8ee1e232266a5e9c0c7b4":{"type":"File","value":"e915bc9cc65f24fea407d95cbf28a9fe0bbee76e91c8ee1e232266a5e9c0c7b4"}},"chains":[{"id":"1556906372067791578","root":"File:19c46f63075e1d759cf92575eabee9d40e170098ec9f928ff1e9a3093e620e5a","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1556906359543599818","root":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1556906372459608359","root":"File:5d3dbda56e3ffffefb23f2fd46a5af0c0decc389d70921c453c3f813bb806262","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"sandbox_files","root":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","edges":[{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:c00bd4131a725af53f48c6385d3332c4b789e15441bf52bbac73117c96c1b0ac"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:5d3dbda56e3ffffefb23f2fd46a5af0c0decc389d70921c453c3f813bb806262"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:dab8f3fe073f157f609ad288b33402ab96e94005d8b56ff0fa3bd8c0c27750d3"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:4e41553521bdeab160d5387ae619c713df6699c1b3bb1020fe5b5182caff9bc8"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:5fe1ad802f68d7c47dbbd8e60162ba88abaed162da5d381c85d3e4935311962e"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:429337f44f84b93cd1095df48c8f3265e5ede7c646d1b48d9b80f4f92de74d2c"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:c6ba25014d30a11b97d9d90c3b87f2f0c13d35ef6188ea5c086f48b3933d297f"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:8250d630f8326a0865fb29e8a154485d4ce324497055e0028f6f1312d0c8bd77"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:e6bd718a478c6c3706d3d6ef274ad58f86504383807be4672fa52565e7270627"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:4c4b269e4e9b29c2d358a6810adabb47d4b38b08d13707b04e40a87ed5eb97a6"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:19c46f63075e1d759cf92575eabee9d40e170098ec9f928ff1e9a3093e620e5a"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:d43bc699be8676880a1b93be0190ccea27fa3ed848a683fa6e571a78dd14f36b"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:9dc36e76e6dc6e0e0e5e09df1b099c118089d1676adaba8e83f1cfd3fda2a782"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:bfc220459cc2ee249ca6af4907f4744c5c80c1953dc93442f9eaec77989531fa"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:1186b3a97c2eb73bc60a312a263d04055f383267159b5ac5fcd9debd496d1809"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:e915bc9cc65f24fea407d95cbf28a9fe0bbee76e91c8ee1e232266a5e9c0c7b4"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:d148dc2569e9abc4b4da650b1920ef1ffdc10bbd6bc2e20a97ce44b1f9f78aea"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:a7e560d419e85daf80cce980baa124ef7c73197d0f51a59a19f1866ee8edfe8c"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:9e86e48fb486a3607f6f844e074d6efff939a9370df086dc328bb251b4a0ff7d"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:95f68e235231a4d426feb84a444c4bdfa0d462826a1dfdd4a1511980c151d916"},{"edge_kind":"extracted","from_key":"File:2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","to_key":"File:67c30aa5adaae81639069cc6bdbc3df12851858af87e146f34da254a90db031c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":76,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":65,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","filetour","adinstaller","adware","evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6ac48c0538616b70220b042e","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":75,"malware_family":"Immirat.B","submit_name":"Offline_eBIRForms_Package_v7.9.6.2.exe","analysis_start_time":"2026-10-06T05:49:59+00:00","indicators_count":{"informative":210,"suspicious":55,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6ac18dcd6f0bfc131101c50b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":75,"malware_family":"Immirat.B","submit_name":"Offline_eBIRForms_Package_v7.9.6.2.exe","analysis_start_time":"2026-10-03T23:20:48+00:00","indicators_count":{"informative":208,"suspicious":56,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}],"processes":[{"pid":2600,"ppid":0,"name":"Offline_eBIRForms_Package_v7.9.6.2.exe","command_line":"","sha256":"2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260","normalized_path":"C:\\Offline_eBIRForms_Package_v7.9.6.2.exe","uid":"00000000-00002600","icon":"$78"},{"pid":2168,"ppid":2600,"name":"Offline_eBIRForms_Package_v7.9.6.2.tmp","command_line":"/SL5=\"$401CA,18283059,57856,C:\\Offline_eBIRForms_Package_v7.9.6.2.exe\"","sha256":"cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3","normalized_path":"%TEMP%\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp","parent_uid":"00000000-00002600","uid":"00000000-00002168"}],"all_imported_dlls":["TextInputFramework.dll","user32.dll","gdi32.dll","oleaut32.dll","shell32.dll","cfgmgr32.dll","mpr.dll","bcryptprimitives.dll","advapi32.dll","msvcrt.dll","tiptsf.dll","thumbcache.dll","linkinfo.dll","netutils.dll","cryptsp.dll","uxtheme.dll","msctf.dll","ExplorerFrame.dll","KernelBase.dll","dwmapi.dll","version.dll","msvcp140.dll","ole32.dll","shlwapi.dll","SHCore.dll","powrprof.dll","ntshrui.dll","vcruntime140.dll","msimg32.dll","wow64.dll","comctl32.dll","windows.storage.dll","profapi.dll","WinTypes.dll","RstrtMgr.dll","bcrypt.dll","WindowsCodecs.dll","comdlg32.dll","CoreUIComponents.dll","propsys.dll","aepic.dll","sfc.dll","setupapi.dll","win32u.dll","sechost.dll","wow64cpu.dll","ucrtbase.dll","apphelp.dll","ncrypt.dll","ntasn1.dll","gdi32full.dll","msvcp_win.dll","VxSSL32.dll","clbcatq.dll","ntdll.dll","kernel32.dll","sspicli.dll","cscapi.dll","CoreMessaging.dll","ntmarta.dll","cryptbase.dll","ws2_32.dll","fltLib.dll","cldapi.dll","srvcli.dll","wow64win.dll","rpcrt4.dll","imm32.dll","sfc_os.dll","kernel.appcore.dll","combase.dll","msvcp110_win.dll","ServicingCommon.dll","policymanager.dll","wow64base.dll","TextShaping.dll","wow64con.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"is-B2C61.tmp","sha256":"c00bd4131a725af53f48c6385d3332c4b789e15441bf52bbac73117c96c1b0ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Offline_eBIRForms_Package_v7.9.6.2.tmp","sha256":"cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-6I9RH.tmp","sha256":"5d3dbda56e3ffffefb23f2fd46a5af0c0decc389d70921c453c3f813bb806262","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-44IGJ.tmp","sha256":"dab8f3fe073f157f609ad288b33402ab96e94005d8b56ff0fa3bd8c0c27750d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-6NAMJ.tmp","sha256":"4e41553521bdeab160d5387ae619c713df6699c1b3bb1020fe5b5182caff9bc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-6P4CU.tmp","sha256":"5fe1ad802f68d7c47dbbd8e60162ba88abaed162da5d381c85d3e4935311962e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-ACSKI.tmp","sha256":"429337f44f84b93cd1095df48c8f3265e5ede7c646d1b48d9b80f4f92de74d2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"_setup64.tmp","sha256":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-99C2G.tmp","sha256":"c6ba25014d30a11b97d9d90c3b87f2f0c13d35ef6188ea5c086f48b3933d297f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-FCPU6.tmp","sha256":"8250d630f8326a0865fb29e8a154485d4ce324497055e0028f6f1312d0c8bd77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-0U03C.tmp","sha256":"e6bd718a478c6c3706d3d6ef274ad58f86504383807be4672fa52565e7270627","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-ADLR5.tmp","sha256":"4c4b269e4e9b29c2d358a6810adabb47d4b38b08d13707b04e40a87ed5eb97a6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-P1415.tmp","sha256":"19c46f63075e1d759cf92575eabee9d40e170098ec9f928ff1e9a3093e620e5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-80UNS.tmp","sha256":"d43bc699be8676880a1b93be0190ccea27fa3ed848a683fa6e571a78dd14f36b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-6U8BM.tmp","sha256":"9dc36e76e6dc6e0e0e5e09df1b099c118089d1676adaba8e83f1cfd3fda2a782","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-D1IBC.tmp","sha256":"bfc220459cc2ee249ca6af4907f4744c5c80c1953dc93442f9eaec77989531fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-CU5MS.tmp","sha256":"1186b3a97c2eb73bc60a312a263d04055f383267159b5ac5fcd9debd496d1809","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"is-52N0T.tmp","sha256":"e915bc9cc65f24fea407d95cbf28a9fe0bbee76e91c8ee1e232266a5e9c0c7b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"embedded/images/large1.bmp","sha256":"d148dc2569e9abc4b4da650b1920ef1ffdc10bbd6bc2e20a97ce44b1f9f78aea","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"embedded/images/small1.bmp","sha256":"a7e560d419e85daf80cce980baa124ef7c73197d0f51a59a19f1866ee8edfe8c","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"unins000.dat","sha256":"9e86e48fb486a3607f6f844e074d6efff939a9370df086dc328bb251b4a0ff7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"eBIRForms.lnk","sha256":"95f68e235231a4d426feb84a444c4bdfa0d462826a1dfdd4a1511980c151d916","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Uninstall.lnk","sha256":"67c30aa5adaae81639069cc6bdbc3df12851858af87e146f34da254a90db031c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%TEMP%\\is-UB103.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%TEMP%\\is-C7QRN.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-23TNA.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-K85SF.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-FNNUG.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-IP8HT.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-LKJ17.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-FM4L1.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-59MSA.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-KISM1.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-52N0T.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-NDLAD.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-KAPQ9.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-S4PAS.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-LPC43.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-IBS1D.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\xml\\is-K9DG5.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\savefile\\is-V6M76.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\profile\\is-EU0SI.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\profile\\is-0LPIM.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-BFDPL.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-GTMLL.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-ACU01.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-U6HB2.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-193MH.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-QUVL4.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"C:\\eBIRForms\\is-86K89.tmp","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\eBIRForms\\eBIRForms.lnk","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\eBIRForms\\Uninstall.lnk","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%TEMP%\\is-6CLD4.tmp\\Offline_eBIRForms_Package_v7.9.6.2.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"%TEMP%\\is-1S7K6.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-P1415.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-ADLR5.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-6I9RH.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-ACSKI.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-B2C61.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-RSQ2K.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-CP8BP.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-O33SP.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-E9Q22.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-IEFDP.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-SF2UH.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-RUO1I.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-J3AT0.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-0U03C.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\xml\\is-GR4LI.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\savefile\\is-6U8BM.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\profile\\is-I832I.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\profile\\is-FCPU6.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-6NAMJ.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-80UNS.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-99C2G.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-6P4CU.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-D1IBC.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-CU5MS.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"path":"C:\\eBIRForms\\is-44IGJ.tmp","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"Local\\SM0:2600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"SM0:2600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2168:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2168:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2168:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0af988","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"SM0:2168:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"Local\\SM0:2168:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"},{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"SM0:2168:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac18dcd6f0bfc131101c50b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"SM0:1056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Local\\SM0:1056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5192:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5192:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Local\\SM0:5192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Local\\SM0:5192:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"SM0:5192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"SM0:5192:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6ac48c0538616b70220b042e"}]}]}},"report_ids":{"sandbox_job_ids":["6ac18dcd6f0bfc131101c50b","6ac48c0538616b70220b042e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Immirat.B Sample 2b6dfe185b55… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2b6dfe185b55…. Malware family: Immirat.B. Threat score 75/100. 1/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260"}],["$","meta","4",{"property":"og:title","content":"Malicious Immirat.B Sample 2b6dfe185b55… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2b6dfe185b55…. Malware family: Immirat.B. Threat score 75/100. 1/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2b6dfe185b5521c574e4c136ce3a8476881de201910c077e87061e804aff5260"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Immirat.B Sample 2b6dfe185b55… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2b6dfe185b55…. Malware family: Immirat.B. Threat score 75/100. 1/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L79","11",{}]]