24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 86:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T42f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 3eef9e4cf03a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3eef9e4cf03a…. Threat score 100/100. 0/27 AV engines flagged this file. 16 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e"],"about":{"@type":"SoftwareApplication","name":"disk-drill-win(2).exe","applicationCategory":["peexe","executable"],"identifier":"3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":36},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T97a,"disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{A13977D2-381B-4FBA-A79E-6B13B9BEB784}") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{A13977D2-381B-4FBA-A79E-6B13B9BEB784}.REBOOTREQUIRED") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEUPGRADECODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEADDONCODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEPATCHCODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "BUNDLEDETECTCODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "BUNDLEUPGRADECODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "BUNDLEADDONCODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "BUNDLEPATCHCODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "BUNDLEDETECTCODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "BUNDLEUPGRADECODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SCHEDULINGAGENT"; Key: "BUNDLEUPGRADECODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SCHEDULINGAGENT") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SCHEDULINGAGENT"; Key: "BUNDLEADDONCODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SCHEDULINGAGENT"; Key: "BUNDLEPATCHCODE") "disk-drill-win_2_.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SCHEDULINGAGENT"; Key: "BUNDLEDETECTCODE")26:Tac8,"Failed to open log." (Indicator: "open") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to connect to unelevated process." (Indicator: "connect") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to connect to parent of embedded process." (Indicator: "connect") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to select variable nodes." (Indicator: "select") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "RtlGetVersion" (Indicator: "GetVersion") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to locate RtlGetVersion." (Indicator: "GetVersion") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "DllGetVersion" (Indicator: "GetVersion") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to find DllGetVersion entry point in msi.dll." (Indicator: "GetVersion") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to open Windows folder key." (Indicator: "open") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to select condition node." (Indicator: "select") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to select search nodes." (Indicator: "select") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to open registry key. Key = '%ls'" (Indicator: "open") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to open registry key." (Indicator: "open") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to open handle to engine process path." (Indicator: "open") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to select approved exe nodes." (Indicator: "select") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to select container nodes." (Indicator: "select") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to open attached container." (Indicator: "open") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to open file: %ls" (Indicator: "open") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to open container." (Indicator: "open") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin "Failed to select catalog nodes." (Indicator: "select") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin27:T662,"DiskDrillSetup.4.5.616.0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.be\DiskDrillSetup.4.5.616.0.exe]- [targetUID: 00000000-00003548] "wixstdba.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\wixstdba.dll]- [targetUID: 00000000-00003548] "disk-drill-win_2_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Temp\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\.cr\disk-drill-win_2_.exe]- [targetUID: 00000000-00003548] "thm.wxl" has type "XML 1.0 document UTF-8 Unicode text with CRLF line terminators"- Location: [%WINDIR%\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1055\thm.wxl]- [targetUID: 00000000-00003548] "logo.png" has type "PNG image data 420 x 474 8-bit/color RGBA non-interlaced"- Location: [%WINDIR%\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\logo.png]- [targetUID: 00000000-00003548] "thm.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%WINDIR%\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1055\thm.wxl]- [targetUID: 00000000-00003548] "BootstrapperApplicationData.xml" has type "XML 1.0 document Little-endian UTF-16 Unicode text with very long lines with CRLF line terminators"- Location: [%WINDIR%\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\BootstrapperApplicationData.xml]- [targetUID: 00000000-00003548] "thm.wxl" has type "Unknown"- Location: [%WINDIR%\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1055\thm.wxl]- [targetUID: 00000000-00003548]28:T658,"disk-drill-win_2_.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\.cr\disk-drill-win_2_.exe" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1036\thm.wxl" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1042\thm.wxl" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.be\DiskDrillSetup.4.5.616.0.exe" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\thm.wxl" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\logo.png" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1025\thm.wxl" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1031\thm.wxl" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1033\thm.wxl" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1034\thm.wxl" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1043\thm.wxl" "disk-drill-win_2_.exe" touched file "C:\Windows\Temp\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\.ba\1045\thm.wxl"29:Tdac,Pattern match: "crl.comodoca.com/AAACertificateServices.crl04"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://ocsp.comodoca.com0"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://ocsp.sectigo.com0"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "https://sectigo.com/CPS0"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://ocsp.sectigo.com0D"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "crl.sectigo.com/SectigoRSATimeStampingCA.crl0t"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "crt.sectigo.com/SectigoRSATimeStampingCA.crt0#"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://ocsp.usertrust.com0"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Heuristic match: ")t8ZXm.Py"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://appsyndication.org/2006/appsyn"- [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin] Pattern match: "http://schemas.microsoft.com/wix/2006/localization"- [Source: thm.wxl] Pattern match: "http://schemas.microsoft.com/wix/2010/BootstrapperApplicationData"- [Source: BootstrapperApplicationData.xml] Pattern match: "https://support.microsoft.com/en-us/kb/2999226"- [Source: BootstrapperApplicationData.xml] Pattern match: "https://download.visualstudio.microsoft.com/download/pr/8ecb9800-52fd-432d-83ee-d6e037e96cc2/50A3E92ADE4C2D8F310A2812D46322459104039B9DEADBD7FDD483B5C697C0C8/VC_redist.x86.exe"- [Source: BootstrapperApplicationData.xml] Pattern match: "https://download.visualstudio.microsoft.com/download/pr/89a3b9df-4a09-492e-8474-8f92c115c51d/B1A32C71A6B7D5978904FB223763263EA5A7EB23B2C44A0D60E90D234AD99178/VC_redist.x64.exe"- [Source: BootstrapperApplicationData.xml] Pattern match: "https://download.visualstudio.microsoft.com/download/pr/8e396c75-4d0d-41d3-aea8-848babc2736a/80b431456d8866ebe053eb8b81a168b3/ndp462-kb3151800-x86-x64-allos-enu.exe"- [Source: BootstrapperApplicationData.xml] Pattern match: "https://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/DokanSetup.exe"- [Source: BootstrapperApplicationData.xml] Pattern match: "https://cleverfiles.com/help/eula"- [Source: BootstrapperApplicationData.xml]2a:Tf65," Observed import api AdjustTokenPrivileges which can "Enables or disables privileges in the specified access token" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api AllocateAndInitializeSid which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api CheckTokenMembership which can "Determines whether a specified security identifier (SID) is enabled in an access token" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api CreateWellKnownSid which can "Creates a SID for predefined aliases" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api GetTokenInformation which can "Retrieves a specified type of information about an access token" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api InitializeAcl which can "Initializes a new ACL structure" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api InitializeSecurityDescriptor which can "Initializes a new security descriptor" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api InitializeSid which can "Initializes a security identifier (SID)" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api SetSecurityDescriptorDacl which can "Sets information in a discretionary access control list (DACL)" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api SetSecurityDescriptorGroup which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api SetSecurityDescriptorOwner which can "Sets the owner information of an absolute-format security descriptor" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml" " Observed import api AdjustTokenPrivileges which can "Enables or disables privileges in the specified access token" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api AllocateAndInitializeSid which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api CheckTokenMembership which can "Determines whether a specified security identifier (SID) is enabled in an access token" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api CreateWellKnownSid which can "Creates a SID for predefined aliases" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api GetTokenInformation which can "Retrieves a specified type of information about an access token" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api InitializeAcl which can "Initializes a new ACL structure" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api InitializeSecurityDescriptor which can "Initializes a new security descriptor" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api InitializeSid which can "Initializes a security identifier (SID)" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api SetSecurityDescriptorDacl which can "Sets information in a discretionary access control list (DACL)" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api SetSecurityDescriptorGroup which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" (Source: static-292bcae1f5b2418483328593816f0714.xml" " Observed import api SetSecurityDescriptorOwner which can "Sets the owner information of an absolute-format security descriptor" (Source: static-292bcae1f5b2418483328593816f0714.xml"2b:Tbf1,"disk-drill-win4.exe" called "LoadResource with parameter {'hModule': '1810825216', 'hResInfo': '1811699368'}" (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadResource with parameter {'hModule': '2949121', 'hResInfo': '2949776'}" (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadResource with parameter {'hModule': '1810825216', 'hResInfo': '1811699368'}" (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadResource with parameter {'hModule': '5177345', 'hResInfo': '5178000'}" (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadResource with parameter {'hModule': '15728640', 'hResInfo': '16175816'}" (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadResource with parameter {'hModule': '15728640', 'hResInfo': '16175704'}" (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadResource with parameter {'hModule': '15728640', 'hResInfo': '16175656'}" (UID: 00000000-00002756) "DiskDrillSetup.4.5.616.0.exe" called "LoadResource with parameter {'hModule': '1810825216', 'hResInfo': '1811699368'}" (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadResource with parameter {'hModule': '3604481', 'hResInfo': '3605136'}" (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadResource with parameter {'hModule': '1925120000', 'hResInfo': '1926058176'}" (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadResource with parameter {'hModule': '1802764290', 'hResInfo': '7472144'}" (UID: 00000000-00002124) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '1810825216', 'hResInfo': '1811699368'}" (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '1900545', 'hResInfo': '1901200'}" (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '1810825216', 'hResInfo': '1811699368'}" (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '5111809', 'hResInfo': '5112464'}" (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '19595264', 'hResInfo': '20042536'}" (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '19595264', 'hResInfo': '20042424'}" (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '19595264', 'hResInfo': '20042376'}" (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '1766916096', 'hResInfo': '1767344200'}" (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '1766916096', 'hResInfo': '1767343736'}" (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '1766916096', 'hResInfo': '1767344216'}" (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadResource with parameter {'hModule': '1766916096', 'hResInfo': '1767343768'}" (UID: 00000000-00002348)2c:Ta09,"disk-drill-win4.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr\ (UID: 00000000-00005028) "disk-drill-win4.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\ (UID: 00000000-00005028) "DiskDrillSetup.4.5.616.0.exe" called "RemoveDirectoryW" with parameter %ALLUSERSPROFILE%\Package Cache\.unverified\ (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "RemoveDirectoryW" with parameter %ALLUSERSPROFILE%\Package Cache\{8D511363-7ED6-4534-A2B9-678B1A7C4328}v4.5.616.0\ (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "RemoveDirectoryW" with parameter %ALLUSERSPROFILE%\Package Cache\ (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "RemoveDirectoryW" with parameter %ALLUSERSPROFILE%\Package Cache\{a13977d2-381b-4fba-a79e-6b13b9beb784}\ (UID: 00000000-00002124) "DokanSetup.1.4.1.1000.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{10423C26-E71D-44B2-B629-F7E289357C3C}\.cr\ (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{10423C26-E71D-44B2-B629-F7E289357C3C}\ (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\Resources\1033\ (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\Resources\ (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\ (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.be\ (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "RemoveDirectoryW" with parameter %WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\ (UID: 00000000-00002348) "DokanSetup.exe" called "RemoveDirectoryW" with parameter %ALLUSERSPROFILE%\Package Cache\.unverified\ (UID: 00000000-00004380) "DokanSetup.exe" called "RemoveDirectoryW" with parameter %ALLUSERSPROFILE%\Package Cache\{65A3A986-3DC3-0104-0001-210114105723}v1.4.1.1000\ (UID: 00000000-00004380) "DokanSetup.exe" called "RemoveDirectoryW" with parameter %ALLUSERSPROFILE%\Package Cache\ (UID: 00000000-00004380) "DokanSetup.exe" called "RemoveDirectoryW" with parameter %ALLUSERSPROFILE%\Package Cache\{9af3b5e1-ed1b-48df-a34f-22fa6bcc4b04}\ (UID: 00000000-00004380)2d:Teab,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "disk-drill-win4.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "disk-drill-win4.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "disk-drill-win4.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "disk-drill-win4.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "disk-drill-win4.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "disk-drill-win4.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "erviceThreadMain: SetWaitableTimer failed." (Indicator: "SetWaitableTimer"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp, 00000000-00001936.00000002.316238.01112000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp, 00000000-00001936.00000002.316238.01112000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")2e:T649,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "disk-drill-win4.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "disk-drill-win4.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "disk-drill-win4.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")2f:Ta0d,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "disk-drill-win4.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "disk-drill-win4.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "disk-drill-win4.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "disk-drill-win4.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")30:T4c8,Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "disk-drill-win4.exe") Found reference to API "ControlService" (Indicator: "ControlService"; File: "disk-drill-win4.exe") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "ControlService failed." (Indicator: "ControlService"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")31:T485,Found string - \\.\pipe\%ls; Source: "disk-drill-win4.exe") Found string - \\.\pipe\%ls.Cache; Source: "disk-drill-win4.exe") Found string - \\.\pipe\BurnPipe.{D25F2013-007E-4FD2-9CA0-AA2EFF12545E}; Source: "00000000-00002756-00000C56-3857373321") Found string - \\.\pipe\BurnPipe.{D25F2013-007E-4FD2-9CA0-AA2EFF12545E}.Cache; Source: "00000000-00002756-00000C56-3857374549") Found string - \\.\pipe\BurnPipe.{7B27780B-0B1C-479B-9776-AA4616B328C9}; Source: "00000000-00002124-00000C56-3934571892") Found string - \\.\pipe\BurnPipe.{39776088-EBC0-4BED-9240-DAD20CA1C2C8}; Source: "00000000-00002348-00000C56-3943402439") Found string - \\.\pipe\BurnPipe.{39776088-EBC0-4BED-9240-DAD20CA1C2C8}.Cache; Source: "00000000-00002348-00000C56-3943403925") Found string - \\.\pipe\%ls; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string - \\.\pipe\%ls.Cache; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string - \\.\pipe\%ls; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string - \\.\pipe\%ls.Cache; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")32:T49d,"DiskDrillSetup.4.5.616.0.exe" renamed original file"C:\Windows\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\DD.Setup.x86.msi" to "%ALLUSERSPROFILE%\Package Cache\.unverified\DD.Setup.x86.msi" "DiskDrillSetup.4.5.616.0.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\DD.Setup.x86.msi" to "%ALLUSERSPROFILE%\Package Cache\{8D511363-7ED6-4534-A2B9-678B1A7C4328}v4.5.616.0\DD.Setup.x86.msi" "DiskDrillSetup.4.5.616.0.exe" renamed original file"C:\Windows\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\DokanSetup.exe" to "%ALLUSERSPROFILE%\Package Cache\.unverified\DokanSetup.exe" "DiskDrillSetup.4.5.616.0.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\DokanSetup.exe" to "%ALLUSERSPROFILE%\Package Cache\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\DokanSetup.1.4.1.1000.exe" "DokanSetup.exe" renamed original file"C:\Windows\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\Dokan_x86.msi" to "%ALLUSERSPROFILE%\Package Cache\.unverified\Dokan_x86.msi" "DokanSetup.exe" renamed original file"C:\ProgramData\Package Cache\.unverified\Dokan_x86.msi" to "%ALLUSERSPROFILE%\Package Cache\{65A3A986-3DC3-0104-0001-210114105723}v1.4.1.1000\Dokan_x86.msi"33:T480,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005028-53864-56-01028286 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005028-53864-56-01028286 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005028-53864-52-010280C3 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005028-53864-52-010280C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005028-53864-27-010234A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005028-53864-27-010234A2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005028-53864-72-01024189 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005028-53864-72-01024189 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005028-53864-51-010282DC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005028-53864-51-010282DC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00000336-3709-1260-01070EA0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00000336-3709-1260-01070EA034:T4b2,Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "disk-drill-win4.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "disk-drill-win4.exe") Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; File: "disk-drill-win4.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "disk-drill-win4.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "disk-drill-win4.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "disk-drill-win4.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "disk-drill-win4.exe") Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; File: "disk-drill-win4.exe") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; File: "disk-drill-win4.exe") Found reference to API "CryptHashPublicKeyInfo" (Indicator: "CryptHashPublicKeyInfo"; File: "disk-drill-win4.exe") Found reference to API "CryptCATAdminCalcHashFromFileHandle" (Indicator: "CryptCATAdminCalcHashFromFileHandle"; File: "disk-drill-win4.exe")35:T49f,Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; File: "disk-drill-win4.exe") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; File: "disk-drill-win4.exe") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "DecryptFileW" (Indicator: "DecryptFile"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")36:T440,Found string "Failed to get certificate public key identifier." (Indicator: "public key"; File: "disk-drill-win4.exe") Found string "Failed to find expected public key in certificate chain." (Indicator: "public key"; File: "disk-drill-win4.exe") Found string "Failed to get certificate public key identifier." (Indicator: "public key"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to find expected public key in certificate chain." (Indicator: "public key"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found string "Failed to get certificate public key identifier." (Indicator: "public key"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string "Failed to find expected public key in certificate chain." (Indicator: "public key"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")37:T47e,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]38:T4e7,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "disk-drill-win4.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "disk-drill-win4.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "disk-drill-win4.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "wixstdba.dll") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")39:T98b,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "disk-drill-win4.exe") file/memory contains long string with (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "Disk_Drill_4.5.616.0_20250322210059.log") file/memory contains long string with (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "MSIB33B.tmp") file/memory contains long string with (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "Dokan_Library_1.4.1.1000_Bundle_20250323092124.log") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "ting session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a13977d2-381b-4fba-a79e-6b13b9beb784}, resume: Active, restart initiated: No, disable resume: No" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp") Found string "C:0AD4][2025-03-22T21:11:20]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a13977d2-381b-4fba-a79e-6b13b9beb784}, resume: Active, restart initiated: No, disable resume: No" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp") Found string "[084C:0AD4][2025-03-22T21:11:20]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a13977d2-381b-4fba-a79e-6b13b9beb784}, resume: Active, restart initiated: No, disable resume: No" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string "[111C:0F84][2025-03-23T11:46:11]i370: Session begin, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9af3b5e1-ed1b-48df-a34f-22fa6bcc4b04}, options: 0x7, disable resume: Yes" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp")3a:T4f9,"disk-drill-win4.exe" called "GetWindowTextW" with parameter "Disk Drill" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "Version 4.5.616.0" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "&Options" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "Thank you for choosing Disk Drill, proceed with installation?" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "&Install" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "By proceeding you accept our EULA" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "&Browse" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "&OK" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "&Cancel" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "Share anonymous app info with CleverFiles" - (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetWindowTextW" with parameter "Close the &applications and attempt to restart them." - (UID: 00000000-00002756)3b:T256f,"disk-drill-win4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e20500e7c400370001000000000000000a00000008000000d8c03c00d8c03c00d3c03c00000000000000000000003700000000010cdb2100020000008cdd210095e124773d305100feffffff435c2877505928770010000008100000d2c03c00d0c03c0001000000ee29287701000000000000000000000000000000000000001800000066554920338e4f6af0ed20000000000038dc2100c89f287768bcfb6b00000000000000006cdc210025c9ef6b33c9ef6b91ee8a20010000009cdc21000300000000000000081000008cdd210088dc2100958df16b0000370008000000 (UID: 00000000-00005028) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003e0080e33e007be33e0000000000000000000000370000000001a4d321000000000008e1210095e124773d305100feffffff435c287750592877aa000000b80000007ae33e0078e33e002cd5210064d9210000000000000000000000000000000000000000000000000000000000000000001c5c277760d81675ffffffff17000000dcd421002400000003000000ccd92100f8de210064d921008600000008d5210096ed2877a2e33e00a06afe74860000002cd5210064d921000000000086008800a06afe742cd52100916cfe74a2e33e00a06afe74a06afe749cd9210002020000 (UID: 00000000-00005028) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005028) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002400c86f2400d87f2700707324000000000000000000ecec1c0028120b007cec1c0080f46d7500000b000000000089f46d75b118a71e02000000f0ec1c00ecec1c003c14470000000b0000000001a4eb1c003ff0000040ec1c00c83a7775b4ec1c00d58c6f75f0ec1c0084ec1c0042a46d75a8027775c4ec1c00d2f46d75080000006ef56d7544f56d750918a71e02000000d065476f00001d00a46c476f98ec1c000200000000001d00d065476fc8ec1c0042a46d75a80277750ced1c00c07e476f08000000957e476f6a57d96002000000d065476f00001d00a46c476f80120b00 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000063040067c400240001000000000000000a00000008000000d0fc2900d0fc2900cbfc290000000000000000000000240000000001ccdc1c00020000004cdf1c0095e1247793395100feffffff435c2877505928770010000008100000cafc2900c8fc290001000000ee29287701000000000000000000000000000000000000001800000038bd561e338e4f6ab0ef1b0000000000f8dd1c00c89f287768bcfb6b00000000000000002cde1c0025c9ef6b33c9ef6b4549a760010000005cde1c000300000000000000081000004cdf1c0048de1c00958df16b0000240008000000 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000288e561e338e4f6aa0001c006a6c2b7774f01c00d0bb4f6a0cf01b74feffffff34ef1c0003444e6a0000000040f01c008f8bbd1513444e6a2c48c2730000000040f01c00 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000c09a3b1c (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008953b1c000000004cfa71024cfa710250b2be7397b2be731d638a6000000000c4b1466c010000000100000078fa71021cfa71020000000038fb7102eed4b47321c03a11feffffff97b2be732bb3be73000000000010000000000100fffffe7f03000000040000004a020000000001000600004f940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47c27340ba2c008c47c273 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000260000004a711400000000000000f0000000f0004a710000000034e57102b8e5710094e8710295e124772b335100feffffffb2f42877c0f828770100000000004a7100000000000000008ce57102c4e77102ff2b2877a3cd0875e055cb73ac0124000000240002032a77000200002b0025003368948c08e87102a4012a77c0e57102000000002c0020003368948c4d00330032002e00b87124006c000000200000000e0100000000000048362800a86e2400c86f240058bf28007073240000000b0094e571020100000088e7710295e1247700000000dce6710278960b006ce67102 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000e10f00008ce571021b0000001b00000017682877c81d290000000000435c2877ff2b2877ffce0875e41d2900ac0124000000240000000000000000002a002a003968948c9832240000000000e10f0000000000002b0025003968948c604f2d0000000000b8712400ff2b287737ce08752c75cb73ac01240000002400a86e2400c86f240029002f003968948c00000000c0e471020000000088e771022a002a003968948c88e7710295e12477b8712400feffffff20000000dd5929770000000048362800a86e2400c86f2400a8bf280070732400 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002a774c522c0038007300000000000000000078fd2b0068e5710221af257734522c00a4e5710265b025776db025771fce0875feffffffd0e57102000000006db025770000000074e57102e4e57102ece5710295e124779b3a5100feffffffff2b287797cd0875f46ea973ac0124000000240029002f0001000000905ecb730a000000fd97c875677dd51c2a002a00010000000000000000000000d0e57102b8e57102b8712400ff2b2877200000000200000000000000e8362800a86e2400c86f2400804e29007073240000000000dce6710200970b006ce6710280f46d7568e87102 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000007102010000006cdd7102b2f428775bf7087500000000988a26000000b07018001a00d0000000e8000000e800b07000000000a4dc7102b8dd710204e0710295e124772b335100ff2b2877dff6087544e1b370ac0124000000240000000000000000001100a700ff060000c7022a770100000028dd7102000000001200a200ff0600000002000000000000b871240078df71022000000030dd710200000000e8362800a86e2400c86f2400405229007073240000002377e0dc71023414b07060de710295e12477ab375100feffffffff2b28779a2a287744e1b37034e1b37000000000 (UID: 00000000-00002756) "disk-drill-win4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002d000000000000000000000024000000000104eb1c000000000094ec1c0095e1247793395100feffffff435c287750592877000300000803000082d52d0080d52d00000000000003000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000803000000000000a4ec1c00fcc0167500002400080010000dc11675ba77b81e00000000400000000000000000000000000000000000000000000000 (UID: 00000000-00002756)3c:T1833,"disk-drill-win4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47c27340ba2c008c47c2730000000040ba2c00f8fa7102086d28771881307700000000c4b1466c000000001c09280038fb710295e124777b3a5100feffffff6b2c2977311917750210000000000000000001000cfb7102c89f28778c47c2730000000000000000 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efefc973beee0d630200000044c7c97300007202aecac973ac960b0078960b00c8e671020000000088e7710244d6ca73b2e7b512feffffffefefc9736defc973aecac9731ce7710290e8c973aecac97367c16d752875cb7338e77102c2c6c9732875cb730000000068e8710200000000 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a61ca473a6ee0d6302000000d416a47300007202ff18a47304970b0000970b00c8e67102020000004ddfdc7579dfdc75f8e671022e0030009c1ba473f8e67102000000001ce77102961ba4739c1ba47367c16d75f06ea97338e77102b216a473f06ea9730000000068e8710200000000 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebec75d8972e0000c0fd7f9a5c297700f0fd7f08bf1c0044c0fd7f00000000400000003f0000002500000000c0fd7ffcbe1c00c15c2977608230772500000000c0fd7f9a5c297700f0fd7f20bf1c00578928778083307713171775d8ebec75 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002756) "DiskDrillSetup.4.5.616.0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100771a625100feffffff64f8287788ff287700002377030000000000000088000000f5f6287758ef2300459d6d7500003600000000008000000002000000000024009c1d64736cef23006c22647380000000d3226473dcf0647388ef2300741d6473dcf0647300000000b8f0230000000000 (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebec75b80f44000030fd7f9a5c297700f0fd7fc8ee23004430fd7f00000000400000003f0000001b0000000030fd7fbcee2300c15c2977608230771b0000000030fd7f9a5c297700f0fd7fe0ee2300578928778083307713171775d8ebec75 (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002124) "DokanSetup.1.4.1.1000.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47c27350812f008c47c2730000000050812f00e8fc0a02086d28771881307700000000c4b1ef690000000014d92e0028fd0a0295e12477b7885300feffffff6b2c297731191775021000000000000000000100fcfc0a02c89f28778c47c2730000000000000000 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efefc9736510a1020200000044c7c97300000b02aecac973ac966c0078966c00b8e80a020000000078e90a0244d6ca7379176273feffffffefefc9736defc973aecac9730ce90a0290e8c973aecac97367c16d752875cb7328e90a02c2c6c9732875cb730000000058ea0a0200000000 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000a61ca4739d10a10202000000d416a47300000b02ff18a47304976c0000976c00b8e80a02020000004ddfdc7579dfdc75e8e80a022e0030009c1ba473e8e80a02000000000ce90a02961ba4739c1ba47367c16d75f06ea97328e90a02b216a473f06ea9730000000058ea0a0200000000 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310002000000000000000014ee0a0202000000000000001000000054ed0a0270ed0a02c976167500002b0000001400da761675e836afe9000000000000516901000000935c297700000000000000000000000038ed0a020100000008f00a02bd06187578adb39e00000000bd14516970913300 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebec7560a634000030fd7f9a5c297700f0fd7f00bd1c004430fd7f00000000400000003f000000250000000030fd7ff4bc1c00c15c297760823077250000000030fd7f9a5c297700f0fd7f18bd1c00578928778083307713171775d8ebec75 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002348)3d:T60c,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "disk-drill-win4.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "disk-drill-win4.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "disk-drill-win4.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp, 00000000-00001936.00000002.316238.01112000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")3e:T4fa,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "disk-drill-win4.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "disk-drill-win4.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp, 00000000-00001936.00000002.316238.01112000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")3f:T83f,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "disk-drill-win4.exe") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "disk-drill-win4.exe") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "disk-drill-win4.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "disk-drill-win4.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")40:T60c,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "disk-drill-win4.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "disk-drill-win4.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "disk-drill-win4.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp, 00000000-00001936.00000002.316238.01112000.00000004.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")41:T743,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "disk-drill-win4.exe") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "disk-drill-win4.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "disk-drill-win4.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "disk-drill-win4.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp")42:Tf71,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "disk-drill-win4.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "disk-drill-win4.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "disk-drill-win4.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "disk-drill-win4.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "disk-drill-win4.exe") Found reference to API "Failed to locate RtlGetVersion." (Indicator: "GetVersion"; File: "disk-drill-win4.exe") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; File: "disk-drill-win4.exe") Found reference to API "Failed to find DllGetVersion entry point in msi.dll." (Indicator: "GetVersion"; File: "disk-drill-win4.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "disk-drill-win4.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "disk-drill-win4.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "Failed to locate RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "Failed to find DllGetVersion entry point in msi.dll." (Indicator: "GetVersion"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "1314534552923,2772,3024,,RtlGetVersion,NTDLL.dll,"253:15:25.190",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "Failed to locate RtlGetVersion." (Indicator: "GetVersion"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "Failed to find DllGetVersion entry point in msi.dll." (Indicator: "GetVersion"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")43:T786,"disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")44:T424,Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "disk-drill-win4.exe") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "disk-drill-win4.exe") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")45:Ta80,"disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")46:T597,"disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "disk-drill-win4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "disk-drill-win4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB")47:Tc59,"disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\ (UID: 00000000-00005028) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr (UID: 00000000-00005028) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1025\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1031\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1033\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1034\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1036\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1040\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1041\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1042\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1043\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1045\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1046\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1049\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\2073\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1053\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1055\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1081\ (UID: 00000000-00002756) "disk-drill-win4.exe" called "CreateDirectoryW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1086\ (UID: 00000000-00002756)48:T467,"disk-drill-win4.exe" called "CreateProcessW" with parameter ""%WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr\disk-drill-win4.exe" -burn.clean.room="C:\disk-drill-win4.exe" -burn.f" - (UID: 00000000-00005028) "disk-drill-win4.exe" called "CreateProcessW" with parameter ""%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.be\DiskDrillSetup.4.5.616.0.exe" -q -burn.elevated BurnPipe.{D25F2013-007" - (UID: 00000000-00002756) "DiskDrillSetup.4.5.616.0.exe" called "CreateProcessW" with parameter ""%ALLUSERSPROFILE%\Package Cache\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\DokanSetup.1.4.1.1000.exe" /norestart /quiet /install -burn" - (UID: 00000000-00002124) "DokanSetup.1.4.1.1000.exe" called "CreateProcessW" with parameter ""%WINDIR%\Temp\{10423C26-E71D-44B2-B629-F7E289357C3C}\.cr\DokanSetup.1.4.1.1000.exe" -burn.clean.room="%ALLUSERSPROFILE%\Package Ca" - (UID: 00000000-00000336), "DokanSetup.1.4.1.1000.exe" called "CreateProcessW" with parameter ""%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.be\DokanSetup.exe" -q -burn.elevated BurnPipe.{39776088-EBC0-4BED-9240-DA" - (UID: 00000000-00002348)49:T55cf,"disk-drill-win4.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00005028) "disk-drill-win4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\AdvApi32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Msi.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\wixstdba.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\bafunctions.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr\disk-drill-win4.exe (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ucrtbase.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ucrtbase.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\Drivers\dokan1.sys (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Wintrust.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002756) "disk-drill-win4.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002756) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\srclient.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wups.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wu.upgrade.ps.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter vsstrace.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter OLEAUT32 (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00002124) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\wixstdba.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\bafunctions.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\Temp\{10423C26-E71D-44B2-B629-F7E289357C3C}\.cr\DokanSetup.1.4.1.1000.exe (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Riched20.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter USP10.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter msls31.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Wintrust.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00002348) "DokanSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter Cabinet.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msxml3r.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\srclient.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wups.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wu.upgrade.ps.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00004380) "DokanSetup.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00004380)4a:T1156b,"disk-drill-win4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005028) "disk-drill-win4.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005028) "disk-drill-win4.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005028) "disk-drill-win4.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00005028) "disk-drill-win4.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005028) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005028) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005028) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SystemFunction040 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter MsiDeterminePatchSequenceW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter MsiDetermineApplicablePatchesW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter MsiEnumProductsExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter MsiGetPatchInfoExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter MsiGetProductInfoExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter MsiSetExternalUIRecord (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter MsiSourceListAddSourceExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BootstrapperApplicationCreate (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetTextExtentExPointWPri (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DrawThemeParentBackgroundEx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InternetOpenW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InternetSetOptionW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InternetCrackUrlW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InternetConnectW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter HttpOpenRequestW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter HttpSendRequestW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InitializeSecurityContextA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter QueryContextAttributesA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter HTTPSCertificateTrust (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter HTTPSFinalProv (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetSignatureInterface (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter HttpQueryInfoW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SealMessage (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter UnsealMessage (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CoInternetIsFeatureEnabledForUrl (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter GetRngInterface (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00002756) "disk-drill-win4.exe" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00002756) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter SRSetRestorePointW (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002124) "DiskDrillSetup.4.5.616.0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002124) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiDeterminePatchSequenceW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiDetermineApplicablePatchesW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiEnumProductsExW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiGetPatchInfoExW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiGetProductInfoExW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiSetExternalUIRecord (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiSourceListAddSourceExW (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00000336) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiDeterminePatchSequenceW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiDetermineApplicablePatchesW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiEnumProductsExW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiGetPatchInfoExW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiGetProductInfoExW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiSetExternalUIRecord (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter MsiSourceListAddSourceExW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter BootstrapperApplicationCreate (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RtlUnhandledExceptionFilter (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RtlIsThreadWithinLoaderCallout (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetTextExtentExPointWPri (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ScriptGetProperties (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ScriptItemize (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter BootstrapperApplicationDestroy (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002348) "DokanSetup.1.4.1.1000.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002348) "DokanSetup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter Wow64EnableWow64FsRedirection (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SRSetRestorePointW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004380) "DokanSetup.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004380)4b:T4bc,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "disk-drill-win4.exe") Found reference to API "Failed to CreateProcess on path: %ls" (Indicator: "CreateProcess"; File: "disk-drill-win4.exe") Found reference to API "4187374299797,4616,3141,,CreateProcessW,kernel32.dll,"253:07:35.488",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.315653.002D0000.00000004.mdmp, 00000000-00000336.00000002.318417.00305000.00000004.mdmp") Found reference to API "Failed to CreateProcess on path: %ls" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "Failed to CreateProcess on path: %ls" (Indicator: "CreateProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")4c:T442,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "disk-drill-win4.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "disk-drill-win4.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "disk-drill-win4.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")4d:T513,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "disk-drill-win4.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "disk-drill-win4.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "disk-drill-win4.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")4e:T62b,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "disk-drill-win4.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "disk-drill-win4.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "disk-drill-win4.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")4f:T56a,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "disk-drill-win4.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "disk-drill-win4.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")50:T5aa,"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00001936.00000002.316238.00150000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00001936.00000002.316238.001FC000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002348.00000001.317721.002B0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002348.00000001.317721.002B0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002348.00000001.317721.002B0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002348.00000001.317721.002B0000.00000004.mdmp51:T1b8b,"SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: disk-drill-win4.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: disk-drill-win4.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: disk-drill-win4.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: disk-drill-win4.exe "SOFTWARE\%ls\Updates\" in Source: disk-drill-win4.exe "uSOFTWARE\Policies\Microsoft\Windows\Installer" in Source: disk-drill-win4.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: disk-drill-win4.exe "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: disk-drill-win4.exe "pSOFTWARE\Policies\" in Source: disk-drill-win4.exe "Software\Classes\Installer\Dependencies\" in Source: disk-drill-win4.exe "Software\Microsoft\Windows" in Source: 00000000-00000336.00000000.315653.002D0000.00000004.mdmp 00000000-00000336.00000002.318417.00305000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "SOFTWARE\%ls\Updates\" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "Software\Classes\Installer\Dependencies\" in Source: 00000000-00000336.00000000.315653.0109A000.00000002.mdmp "Software\Microsoft\Windows\Curre" in Source: 00000000-00001936.00000001.314312.00150000.00000004.mdmp 00000000-00001936.00000002.316238.001FC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00001936.00000001.314312.008D1000.00000020.mdmp "Software\CleverFiles\Disk Drill" in Source: 00000000-00001936.00000001.314312.010D5000.00000004.mdmp 00000000-00001936.00000002.316238.010D5000.00000004.mdmp "Software\Microsoft\Disk Drill" in Source: 00000000-00001936.00000001.314312.010D5000.00000004.mdmp 00000000-00001936.00000002.316238.010D5000.00000004.mdmp "402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2" in Source: 00000000-00001936.00000002.316238.00150000.00000004.mdmp "1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2" in Source: 00000000-00001936.00000002.316238.001FC000.00000004.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00001936.00000002.316238.001FC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts" in Source: 00000000-00001936.00000002.316238.001FC000.00000004.mdmp 00000000-00001936.00000002.316238.01112000.00000004.mdmp "OCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress" in Source: 00000000-00001936.00000002.316238.001FC000.00000004.mdmp "1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2" in Source: 00000000-00001936.00000002.316238.01142000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts" in Source: 00000000-00001936.00000002.316238.01142000.00000004.mdmp "ting session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a13977d2-381b-4fba-a79e-6b13b9beb784}, resume: Active, restart initiated: No, disable resume: No" in Source: 00000000-00002124.00000000.310751.003C0000.00000004.mdmp "C:0AD4][2025-03-22T21:11:20]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a13977d2-381b-4fba-a79e-6b13b9beb784}, resume: Active, restart initiated: No, disable resume: No" in Source: 00000000-00002124.00000000.310751.003C0000.00000004.mdmp "[084C:0AD4][2025-03-22T21:11:20]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{a13977d2-381b-4fba-a79e-6b13b9beb784}, resume: Active, restart initiated: No, disable resume: No" in Source: 00000000-00002124.00000000.310751.003C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "SOFTWARE\%ls\Updates\" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "SOFTWARE\Policies\" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "Software\Classes\Installer\Dependencies\" in Source: 00000000-00002124.00000000.310751.00D2A000.00000002.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002124.00000003.318491.00430000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00002124.00000003.318491.00430000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002124.00000003.318491.00430000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002348.00000000.315798.70B01000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002348.00000001.317721.002B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002348.00000001.317721.002B0000.00000004.mdmp 00000000-00002348.00000002.318391.0037F000.00000004.mdmp "[111C:0F84][2025-03-23T11:46:11]i370: Session begin, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9af3b5e1-ed1b-48df-a34f-22fa6bcc4b04}, options: 0x7, disable resume: Yes" in Source: 00000000-00002348.00000001.317721.002B0000.00000004.mdmp52:T8c2,"disk-drill-win4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "disk-drill-win4.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "disk-drill-win4.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "disk-drill-win4.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "disk-drill-win4.exe" failed to load missing module "%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\bafunctions.dll" - [base:0; Status:c0000135] "DiskDrillSetup.4.5.616.0.exe" failed to load missing module "%WINDIR%\system32\TSAPPCMP.DLL" - [base:0; Status:c0000135] "DiskDrillSetup.4.5.616.0.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "DiskDrillSetup.4.5.616.0.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "DokanSetup.1.4.1.1000.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "DokanSetup.1.4.1.1000.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "DokanSetup.1.4.1.1000.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "DokanSetup.1.4.1.1000.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "DokanSetup.1.4.1.1000.exe" failed to load missing module "%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\bafunctions.dll" - [base:0; Status:c0000135] "DokanSetup.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "DokanSetup.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "DokanSetup.exe" failed to load missing module "%WINDIR%\system32\TSAPPCMP.DLL" - [base:0; Status:c0000135] "DokanSetup.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "DokanSetup.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135]53:T48c,"HTTP/1.1 302 FoundServer: GitHub.comDate: Sat, 22 Mar 2025 21:02:21 GMTContent-Type: text/html; charset=utf-8Content-Length: 0Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-WithLocation: https://objec" (Indicator: "github.com") "3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubass" (Indicator: "github.com") "bassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/X-GitHub-Request-Id: C686:764C0:2895F36:35C3D8F:67DF255C" (Indicator: "github.com") "bassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/X-GitHub-Request-Id: A8BD:1A2D21:125E3B9:1808223:67DF255F" (Indicator: "github.com") "ttps://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/DokanSetup.exe" (Indicator: "github.com")54:T470e,"disk-drill-win4.exe" loaded module "CABINET.DLL" at base 71090000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 6bef0000 "disk-drill-win4.exe" loaded module "OLE32.DLL" at base 754d0000 "disk-drill-win4.exe" loaded module "PROFAPI.DLL" at base 75150000 "disk-drill-win4.exe" loaded module "OLEAUT32.DLL" at base 75630000 "disk-drill-win4.exe" loaded module "FECLIENT.DLL" at base 6bee0000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "disk-drill-win4.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "disk-drill-win4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71450000 "disk-drill-win4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "disk-drill-win4.exe" loaded module "KERNEL32" at base 75c40000 "disk-drill-win4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "disk-drill-win4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c740000 "disk-drill-win4.exe" loaded module "KERNEL32.DLL" at base 75c40000 "disk-drill-win4.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77180000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 6f470000 "disk-drill-win4.exe" loaded module "VERSION.DLL" at base 745d0000 "disk-drill-win4.exe" loaded module "CLBCATQ.DLL" at base 75bb0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75c40000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73cc0000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 754d0000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75780000 "disk-drill-win4.exe" loaded module "%WINDIR%\TEMP\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.BA\WIXSTDBA.DLL" at base 6c440000 "disk-drill-win4.exe" loaded module "COMCTL32.DLL" at base 74000000 "disk-drill-win4.exe" loaded module "MSI.DLL" at base 6f470000 "disk-drill-win4.exe" loaded module "WINDOWSCODECS.DLL" at base 734e0000 "disk-drill-win4.exe" loaded module "%WINDIR%\TEMP\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.BA\BAFUNCTIONS.DLL" at base 0 "disk-drill-win4.exe" loaded module "NTDLL.DLL" at base 77230000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 714a0000 "disk-drill-win4.exe" loaded module "DWMAPI.DLL" at base 73990000 "disk-drill-win4.exe" loaded module "UXTHEME.DLL" at base 73cc0000 "disk-drill-win4.exe" loaded module "ADVAPI32.DLL" at base 77180000 "disk-drill-win4.exe" loaded module "IMM32.DLL" at base 75950000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76280000 "disk-drill-win4.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 70b00000 "disk-drill-win4.exe" loaded module "RPCRT4.DLL" at base 75ee0000 "disk-drill-win4.exe" loaded module "PROPSYS.DLL" at base 73d00000 "disk-drill-win4.exe" loaded module "SHELL32.DLL" at base 76280000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d00000 "disk-drill-win4.exe" loaded module "NTMARTA.DLL" at base 745a0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 773f0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 773f0000 "disk-drill-win4.exe" loaded module "CRYPTSP.DLL" at base 74b40000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748d0000 "disk-drill-win4.exe" loaded module "RPCRTREMOTE.DLL" at base 750d0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75420000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76130000 "disk-drill-win4.exe" loaded module "SECUR32.DLL" at base 74e70000 "disk-drill-win4.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75260000 "disk-drill-win4.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71460000 "disk-drill-win4.exe" loaded module "SETUPAPI.DLL" at base 75f90000 "disk-drill-win4.exe" loaded module "WININET.DLL" at base 76ed0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75430000 "disk-drill-win4.exe" loaded module "WS2_32.DLL" at base 77440000 "disk-drill-win4.exe" loaded module "WINHTTP.DLL" at base 70ff0000 "disk-drill-win4.exe" loaded module "CRYPT32.DLL" at base 752c0000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74b00000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74af0000 "disk-drill-win4.exe" loaded module "IPHLPAPI.DLL" at base 73490000 "disk-drill-win4.exe" loaded module "USERENV.DLL" at base 752a0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72d90000 "disk-drill-win4.exe" loaded module "DNSAPI.DLL" at base 749c0000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6e1d0000 "disk-drill-win4.exe" loaded module "DHCPCSVC6.DLL" at base 733a0000 "disk-drill-win4.exe" loaded module "DHCPCSVC.DLL" at base 73320000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74660000 "disk-drill-win4.exe" loaded module "RASADHLP.DLL" at base 6dc80000 "disk-drill-win4.exe" loaded module "URLMON.DLL" at base 76130000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d790000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 75630000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76ed0000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73400000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77440000 "disk-drill-win4.exe" loaded module "CREDSSP.DLL" at base 747d0000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74940000 "disk-drill-win4.exe" loaded module "NCRYPT.DLL" at base 74c70000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74810000 "disk-drill-win4.exe" loaded module "WINTRUST.DLL" at base 753f0000 "disk-drill-win4.exe" loaded module "GPAPI.DLL" at base 74710000 "disk-drill-win4.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 773f0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 773f0000 "disk-drill-win4.exe" loaded module "USER32.DLL" at base 75dc0000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72fc0000 "disk-drill-win4.exe" loaded module "CRYPTNET.DLL" at base 72fc0000 "disk-drill-win4.exe" loaded module "SHLWAPI.DLL" at base 75470000 "disk-drill-win4.exe" loaded module "SENSAPI.DLL" at base 6b790000 "disk-drill-win4.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 752c0000 "disk-drill-win4.exe" loaded module "SSPICLI.DLL" at base 74fc0000 "disk-drill-win4.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 773f0000 "disk-drill-win4.exe" loaded module "NSI.DLL" at base 77380000 "disk-drill-win4.exe" loaded module "CFGMGR32.DLL" at base 75440000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 6bef0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "OLE32.DLL" at base 754d0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "PROFAPI.DLL" at base 75150000 "DiskDrillSetup.4.5.616.0.exe" loaded module "OLEAUT32.DLL" at base 75630000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73cc0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 754d0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\SRCLIENT.DLL" at base 6c420000 "DiskDrillSetup.4.5.616.0.exe" loaded module "NTMARTA.DLL" at base 745a0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "RPCRT4.DLL" at base 75ee0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 773f0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "ADVAPI32.DLL" at base 77180000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\WUAPI.DLL" at base 6a440000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\WUPS.DLL" at base 6c410000 "DiskDrillSetup.4.5.616.0.exe" loaded module "CRYPTSP.DLL" at base 74b40000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748d0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "DiskDrillSetup.4.5.616.0.exe" loaded module "RPCRTREMOTE.DLL" at base 750d0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\WU.UPGRADE.PS.DLL" at base 6c410000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\SPP.DLL" at base 6beb0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\VSS_PS.DLL" at base 70a60000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\VSSAPI.DLL" at base 72bf0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "DSROLE.DLL" at base 736e0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 773f0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 773f0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\ES.DLL" at base 73660000 "DiskDrillSetup.4.5.616.0.exe" loaded module "SXS.DLL" at base 75040000 "DiskDrillSetup.4.5.616.0.exe" loaded module "OLEAUT32" at base 75630000 "DiskDrillSetup.4.5.616.0.exe" loaded module "PROPSYS.DLL" at base 73d00000 "DiskDrillSetup.4.5.616.0.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 773f0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "FECLIENT.DLL" at base 6bee0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "MSI.DLL" at base 6f470000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\TSAPPCMP.DLL" at base 0 "DiskDrillSetup.4.5.616.0.exe" loaded module "NTDLL.DLL" at base 77230000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 75470000 "DiskDrillSetup.4.5.616.0.exe" loaded module "COMCTL32" at base 74000000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75c40000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 73810000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 6f470000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "DiskDrillSetup.4.5.616.0.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75780000 "DiskDrillSetup.4.5.616.0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "DiskDrillSetup.4.5.616.0.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71450000 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "DokanSetup.1.4.1.1000.exe" loaded module "KERNEL32" at base 75c40000 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c740000 "DokanSetup.1.4.1.1000.exe" loaded module "CLBCATQ.DLL" at base 75bb0000 "DokanSetup.1.4.1.1000.exe" loaded module "CABINET.DLL" at base 71090000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 6bef0000 "DokanSetup.1.4.1.1000.exe" loaded module "OLE32.DLL" at base 754d0000 "DokanSetup.1.4.1.1000.exe" loaded module "PROFAPI.DLL" at base 75150000 "DokanSetup.1.4.1.1000.exe" loaded module "OLEAUT32.DLL" at base 75630000 "DokanSetup.1.4.1.1000.exe" loaded module "FECLIENT.DLL" at base 6bee0000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74fe0000 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "DokanSetup.1.4.1.1000.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 0 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75c40000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73cc0000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 754d0000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75780000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\TEMP\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.BA\WIXSTDBA.DLL" at base 69ed0000 "DokanSetup.1.4.1.1000.exe" loaded module "COMCTL32.DLL" at base 74000000 "DokanSetup.1.4.1.1000.exe" loaded module "MSI.DLL" at base 6f470000 "DokanSetup.1.4.1.1000.exe" loaded module "WINDOWSCODECS.DLL" at base 734e0000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\TEMP\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.BA\BAFUNCTIONS.DLL" at base 0 "DokanSetup.1.4.1.1000.exe" loaded module "NTDLL.DLL" at base 77230000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 714a0000 "DokanSetup.1.4.1.1000.exe" loaded module "DWMAPI.DLL" at base 73990000 "DokanSetup.1.4.1.1000.exe" loaded module "UXTHEME.DLL" at base 73cc0000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 69510000 "DokanSetup.1.4.1.1000.exe" loaded module "COMCTL32" at base 74000000 "DokanSetup.1.4.1.1000.exe" loaded module "IMM32.DLL" at base 75950000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76280000 "DokanSetup.1.4.1.1000.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 70b00000 "DokanSetup.1.4.1.1000.exe" loaded module "RPCRT4.DLL" at base 75ee0000 "DokanSetup.1.4.1.1000.exe" loaded module "ADVAPI32.DLL" at base 77180000 "DokanSetup.1.4.1.1000.exe" loaded module "USP10.DLL" at base 75d20000 "DokanSetup.1.4.1.1000.exe" loaded module "MSLS31.DLL" at base 70b60000 "DokanSetup.1.4.1.1000.exe" loaded module "PROPSYS.DLL" at base 73d00000 "DokanSetup.1.4.1.1000.exe" loaded module "SHELL32.DLL" at base 76280000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d00000 "DokanSetup.1.4.1.1000.exe" loaded module "NTMARTA.DLL" at base 745a0000 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 773f0000 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 773f0000 "DokanSetup.1.4.1.1000.exe" loaded module "CRYPTSP.DLL" at base 74b40000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748d0000 "DokanSetup.1.4.1.1000.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "DokanSetup.1.4.1.1000.exe" loaded module "RPCRTREMOTE.DLL" at base 750d0000 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75420000 "DokanSetup.1.4.1.1000.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76130000 "DokanSetup.1.4.1.1000.exe" loaded module "SECUR32.DLL" at base 74e70000 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75260000 "DokanSetup.1.4.1.1000.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71460000 "DokanSetup.1.4.1.1000.exe" loaded module "SETUPAPI.DLL" at base 75f90000 "DokanSetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71450000 "DokanSetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "DokanSetup.exe" loaded module "KERNEL32" at base 75c40000 "DokanSetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "DokanSetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6c740000 "DokanSetup.exe" loaded module "CABINET.DLL" at base 71090000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 6bef0000 "DokanSetup.exe" loaded module "OLE32.DLL" at base 754d0000 "DokanSetup.exe" loaded module "PROFAPI.DLL" at base 75150000 "DokanSetup.exe" loaded module "OLEAUT32.DLL" at base 75630000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73cc0000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 754d0000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75780000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\SRCLIENT.DLL" at base 6c420000 "DokanSetup.exe" loaded module "NTMARTA.DLL" at base 745a0000 "DokanSetup.exe" loaded module "RPCRT4.DLL" at base 75ee0000 "DokanSetup.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 773f0000 "DokanSetup.exe" loaded module "ADVAPI32.DLL" at base 77180000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\WUAPI.DLL" at base 6a440000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\WUPS.DLL" at base 69eb0000 "DokanSetup.exe" loaded module "CRYPTSP.DLL" at base 74b40000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 748d0000 "DokanSetup.exe" loaded module "CRYPTBASE.DLL" at base 75030000 "DokanSetup.exe" loaded module "RPCRTREMOTE.DLL" at base 750d0000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\WU.UPGRADE.PS.DLL" at base 69eb0000 "DokanSetup.exe" loaded module "FECLIENT.DLL" at base 6bee0000 "DokanSetup.exe" loaded module "MSI.DLL" at base 6f470000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\TSAPPCMP.DLL" at base 0 "DokanSetup.exe" loaded module "NTDLL.DLL" at base 77230000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 75470000 "DokanSetup.exe" loaded module "COMCTL32" at base 74000000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75c40000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 73810000 "DokanSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 6f470000 "DokanSetup.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 0 "DokanSetup.exe" loaded module "EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0" at base 055:Tb0f,"disk-drill-win4.exe" was detected as "WiX Toolset installer" and name: "Installer" "disk-drill-win4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "disk-drill-win4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "disk-drill-win4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "disk-drill-win4.exe" was detected as "Microsoft Linker" and name: "Linker" "DokanSetup.exe" was detected as "WiX Toolset installer" and name: "Installer" "DokanSetup.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DokanSetup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DokanSetup.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "DokanSetup.exe" was detected as "Microsoft Linker" and name: "Linker" "DiskDrillSetup.4.5.616.0.exe" was detected as "WiX Toolset installer" and name: "Installer" "DiskDrillSetup.4.5.616.0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DiskDrillSetup.4.5.616.0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DiskDrillSetup.4.5.616.0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "DiskDrillSetup.4.5.616.0.exe" was detected as "Microsoft Linker" and name: "Linker" "wixstdba.dll" was detected as "WiX Toolset installer" and name: "Installer" "wixstdba.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "wixstdba.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "wixstdba.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "wixstdba.dll" was detected as "Microsoft Linker" and name: "Linker" "MSIE458.tmp" was detected as "WiX Toolset installer" and name: "Installer" "MSIE458.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MSIE458.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSIE458.tmp" was detected as "Microsoft Cabinet File" and name: "Archive" "MSIE458.tmp" was detected as "Microsoft Linker" and name: "Linker" "MSIBDD6.tmp" was detected as "WiX Toolset installer" and name: "Installer" "MSIBDD6.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MSIBDD6.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSIBDD6.tmp" was detected as "Microsoft Cabinet File" and name: "Archive" "MSIBDD6.tmp" was detected as "Microsoft Linker" and name: "Linker" "MSIE179.tmp" was detected as "WiX Toolset installer" and name: "Installer" "MSIE179.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MSIE179.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSIE179.tmp" was detected as "Microsoft Cabinet File" and name: "Archive" "MSIE179.tmp" was detected as "Microsoft Linker" and name: "Linker"56:T10c7,"disk-drill-win4.exe" file has an entrypoint instructions - "call 0x42e4b0,jmp 0x42ddf5,int3 ,int3 ,int3 ,int3 ,int3 ,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x42df99,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp cl, 0x40,jae 0x42dfda,cmp cl, 0x20,jae 0x42dfd0,shrd eax, edx, cl,shr edx, cl,ret ,mov eax, edx,xor edx, edx," "DokanSetup.exe" file has an entrypoint instructions - "call 0x42e4b0,jmp 0x42ddf5,int3 ,int3 ,int3 ,int3 ,int3 ,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x42df99,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp cl, 0x40,jae 0x42dfda,cmp cl, 0x20,jae 0x42dfd0,shrd eax, edx, cl,shr edx, cl,ret ,mov eax, edx,xor edx, edx," "DiskDrillSetup.4.5.616.0.exe" file has an entrypoint instructions - "call 0x42e4b0,jmp 0x42ddf5,int3 ,int3 ,int3 ,int3 ,int3 ,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x42df99,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp cl, 0x40,jae 0x42dfda,cmp cl, 0x20,jae 0x42dfd0,shrd eax, edx, cl,shr edx, cl,ret ,mov eax, edx,xor edx, edx," "wixstdba.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000ead1,call 0x1000edfe,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000e992,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp cl, 0x40,jae 0x1000eb0a,cmp cl, 0x20,jae 0x1000eb00,shld edx, eax, cl,shl eax, cl,ret ,mov edx, eax,xor eax, eax,and cl, 0x1f,shl edx, cl,ret ,xor eax, eax,xor edx, edx,ret ,int3 ,push ecx,lea ecx, [esp + 4],sub ecx, eax,sbb eax, eax,not eax,and ecx, eax,mov eax, esp,and eax, 0xfffff000,cmp ecx, eax," "MSIE458.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10004cfb,call 0x10004f9a,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10004bbc,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x10016148],push dword ptr [ebp + 8],call dword ptr [0x10016144],push 0xc0000409,call dword ptr [0x1001614c],push eax,call dword ptr [0x10016150],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x10014bef,test eax, eax,je 0x10004d51,push 2,pop ecx,int 0x29," "MSIBDD6.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100075ba,call 0x10008001,pop ebp,jmp 0x10007349,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,jmp dword ptr [0x1000117c],int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x1000b044],jne 0x100075dc,ret 0,jmp 0x10008097,int3 ,int3 ,int3 ,int3 ,int3 ,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x1000b044],xor eax, ebp,push eax,push dword ptr [ebp - 4]," "MSIE179.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100013c1,call 0x10001545,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000127d,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x10002020],push dword ptr [ebp + 8],call dword ptr [0x10002024],push 0xc0000409,call dword ptr [0x1000201c],push eax,call dword ptr [0x10002018],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x10002014],test eax, eax,je 0x10001418,push 2,pop ecx,"57:T68b,Observed system executable string:"%WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr\disk-drill-win4.exe" [Source: 00000000-00005028-00000C45-251] Observed system executable string:""%WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr\disk-drill-win4.exe" -burn.clean.room="C:\disk-drill-win4.exe" -burn.f" [Source: 00000000-00005028-00000C45-251] Observed system executable string:"%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.be\DiskDrillSetup.4.5.616.0.exe" [Source: 00000000-00002756-00000C45-144243018288] Observed system executable string:""%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.be\DiskDrillSetup.4.5.616.0.exe" -q -burn.elevated BurnPipe.{D25F2013-007" [Source: 00000000-00002756-00000C45-144243018288] Observed system executable string:"%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\DokanSetup.exe" [Source: 00000000-00002756-00000C2C-1459691110304] Observed system executable string:"%WINDIR%\Temp\{10423C26-E71D-44B2-B629-F7E289357C3C}\.cr\DokanSetup.1.4.1.1000.exe" [Source: 00000000-00000336-00000C45-4187374299797] Observed system executable string:""%WINDIR%\Temp\{10423C26-E71D-44B2-B629-F7E289357C3C}\.cr\DokanSetup.1.4.1.1000.exe" -burn.clean.room="%ALLUSERSPROFILE%\Package Ca" [Source: 00000000-00000336-00000C45-4187374299797], Observed system executable string:"%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.be\DokanSetup.exe" [Source: 00000000-00002348-00000C45-15435683845520], Observed system executable string:""%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.be\DokanSetup.exe" -q -burn.elevated BurnPipe.{39776088-EBC0-4BED-9240-DA" [Source: 00000000-00002348-00000C45-15435683845520]58:Tbc0,Observed system executable string:"%WINDIR%\System32\msxml3r.dll" [Source: 00000000-00005028-00000C29-3843688249] Observed system executable string:"%WINDIR%\system32\AdvApi32.dll" [Source: 00000000-00002756-00000C29-3845719204] Observed system executable string:"%WINDIR%\system32\Msi.dll" [Source: 00000000-00002756-00000C29-3845856350] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002756-00000C29-3847100250] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00002756-00000C29-3847380473] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00002756-00000C29-3847528305] Observed system executable string:"%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\wixstdba.dll" [Source: 00000000-00002756-00000C29-3848129969] Observed system executable string:"%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\bafunctions.dll" [Source: 00000000-00002756-00000C29-3848526231] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00002756-00000C29-3849543704] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002756-00000C29-3849985041] Observed system executable string:"%WINDIR%\system32\ucrtbase.dll" [Source: 00000000-00002756-00000C29-3850136719] Observed system executable string:"%WINDIR%\System32\ucrtbase.dll" [Source: 00000000-00002756-00000C29-3850290076] Observed system executable string:"%WINDIR%\system32\Wintrust.dll" [Source: 00000000-00002756-00000C29-3850523370] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00002756-00000C29-3869082305] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00002756-00000C29-3870495194] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00002756-00000C29-3873429767] Observed system executable string:"%WINDIR%\system32\srclient.dll" [Source: 00000000-00002124-00000C29-3861211122] Observed system executable string:"%WINDIR%\system32\wups.dll" [Source: 00000000-00002124-00000C29-3861624560] Observed system executable string:"%WINDIR%\system32\wu.upgrade.ps.dll" [Source: 00000000-00002124-00000C29-3861948086] Observed system executable string:"%WINDIR%\system32\TSAPPCMP.DLL" [Source: 00000000-00002124-00000C29-3884062827] Observed system executable string:"%WINDIR%\system32\SHLWAPI.DLL" [Source: 00000000-00002124-00000C29-3884236327] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00002124-00000C29-3884440043] Observed system executable string:"%WINDIR%\system32\OLE32.DLL" [Source: 00000000-00002124-00000C29-3884656189] Observed system executable string:"%WINDIR%\system32\NETAPI32.DLL" [Source: 00000000-00002124-00000C29-3884743706] Observed system executable string:"%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\wixstdba.dll" [Source: 00000000-00002348-00000C29-3940391354]59:T761,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "disk-drill-win4.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "disk-drill-win4.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "disk-drill-win4.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")5a:T1158,"BootstrapperApplicationData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (607) with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\BootstrapperApplicationData.xml] "thm.xml" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\thm.xml] "thm.xml" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\thm.xml] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1081\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\2073\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1025\thm.wxl] "BootstrapperApplicationData.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with very long lines (530) with CRLF line terminators" - Location: [%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\BootstrapperApplicationData.xml] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1041\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1042\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1055\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1034\thm.wxl] "thm.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1031\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1053\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1036\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1045\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1046\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1040\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1043\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1086\thm.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\2052\thm.wxl] "RtfTheme.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\Resources\1033\RtfTheme.wxl] "thm.wxl" has type "XML 1.0 document Unicode text UTF-8 text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1049\thm.wxl] "thm.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1033\thm.wxl] "thm.wxl" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%WINDIR%\Temp\{48476752-4B44-4866-B67B-6A80E4FF5F57}\.ba\thm.wxl]5b:T801,"disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")5c:Tbc3,"disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DISK-DRILL-WIN4"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "WIN31FILESYSTEM"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\MSXML2.DOMDOCUMENT\CLSID"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDPROCESSES"; Key: "D15C508A"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDSESSIONS"; Key: "MACHINETHROTTLING"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDSESSIONS"; Key: "GLOBALSESSION"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\PROGID"; Key: ""; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}"; Key: ""; Value: "")5d:T4a3,"disk-drill-win4.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "disk-drill-win4.exe" trying to touch file "\Device\KsecDD" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\Msi.dll" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "disk-drill-win4.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "disk-drill-win4.exe" trying to touch file "C:\FLTLIB.DLL" "disk-drill-win4.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "disk-drill-win4.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "disk-drill-win4.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"5e:T48a,"disk-drill-win4.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\FLTLIB.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-1.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\system32\ext-ms-win-kernel32-package-current-l1-1-0.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-1.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\System32\EXT-MS-WIN-KERNEL32-PACKAGE-CURRENT-L1-1-0.DLL" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr\FLTLIB.DLL"5f:T9b4,"disk-drill-win4.exe" trying to access non-existent file "C:\Windows\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr\disk-drill-win4.exe.Local\" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\System32\Drivers\dokan1.sys" "disk-drill-win4.exe" trying to access non-existent file "C:\ProgramData\Package Cache\85354326EF8FBE908D9331446B8C8463577C5633\" "disk-drill-win4.exe" trying to access non-existent file "C:\ProgramData\Package Cache\1786EE165231D491F209FD27B6E3029556AF25BC\" "disk-drill-win4.exe" trying to access non-existent file "C:\ProgramData\Package Cache\053ABDC5B421F50292149F7302F6A1A373CC2D5C\" "disk-drill-win4.exe" trying to access non-existent file "C:\ProgramData\Package Cache\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\" "disk-drill-win4.exe" trying to access non-existent file "C:\ProgramData\Package Cache\{8D511363-7ED6-4534-A2B9-678B1A7C4328}v4.5.616.0\" "disk-drill-win4.exe" trying to access non-existent file "C:\ProgramData\Package Cache\{17F6B007-DBEF-44B1-A692-76760CFE81B6}v4.5.616.0\" "disk-drill-win4.exe" trying to access non-existent file "C:\ProgramData\Package Cache\{a13977d2-381b-4fba-a79e-6b13b9beb784}\" "disk-drill-win4.exe" trying to access non-existent file "C:\Windows\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.be\DiskDrillSetup.4.5.616.0.exe:Zone.Identifier" "disk-drill-win4.exe" trying to access non-existent file "\Device\RasAcd" "disk-drill-win4.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "disk-drill-win4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25" "disk-drill-win4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2E5FB3DF55F6A1FE946987C264867A14" "disk-drill-win4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9" "disk-drill-win4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90" "disk-drill-win4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_0CF5D547EE14BE7C672D39412B9C1C45"60:Te2d,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "disk-drill-win4.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "disk-drill-win4.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "disk-drill-win4.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "disk-drill-win4.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "disk-drill-win4.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "disk-drill-win4.exe") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002756-00000C2A-3868644337") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002756-00000C2A-3868645601") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002756-00000C2A-3873188746") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002756-00000C2A-3875413124") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00002756-00000C2A-3875414944") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00002756-00000C2A-3875414944") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002756-00000C2A-3875414944") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00002756-00000C2A-3880805092") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002756-00000C2A-3880805092") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002756-00000C2A-3881496941") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002756-00000C2A-3881499677") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")61:T18517,Found URL "https://dokan-dev.github.io/" - Source: "00000000-00000336.00000000.315653.002D0000.00000004.mdmp") Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%lskernel32.dll_:w@f:w:whu:wr'wq])w*g?cu(gcu" - Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found URL "https://dokan-dev.github.io/" - Source: "00000000-00000336.00000002.318417.00305000.00000004.mdmp") Found URL "http://ocsp.comodoca.comhttp://crl.comodoca.com/aaacertificateservices.crlprimary" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crlnregistry\user\s-1-5-21-2092356043-4041700817-663127204-1001binary" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0or9iqmgvw,czc0?1$0" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n_wp" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0@zo:" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n;8kb%2+jo9v8!" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:;8kbm" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?3bv:t6a[jr0m0]>-xgjus1!0the" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/pronh0f0d8http://www.>ej-+\li$l,0_afisv" - Source: "00000000-00001936.00000001.314312.01060000.00000004.mdmp") Found URL "http://www.cleverfiles.com/contactsregaa28cb048d52ccc12c14bafb46457ac1rege30bbbe40513364248c294a61af1e6b4ystem\currentcontrolset\services\crypt32microsoft.windowsapicodepack.dllsmart_simplified_chinese.langsmart_traditional_chinese.lang7hzy_qzh" - Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crlhttp://crl.sectigo.com/sectigopubliccodesigningrootr46.crlen-usen-usen-usttp://ocsp.sectigo.com/mfewtzbnmeswstajbgurdgmcgguabbrd0jozuyxmqqw4y4zjtrlcmcrskaqugtksqssozubixklgkjks7eippxqcedkmbv7eakndjkthvt55q5i%3disatap." - Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfewtzbnmeswstajbgurdgmcgguabbsde3gf41waic8uh9lf92%2bijqh5qwqumuusmv81lkgvkebccca2kvwxheycedpxckirqfmz4qw70zm5rw4%3ddatatextpathguidrootfileicon10332057sresolverlugplaya/sha1mappernsresolvermappernsresolverpmapperhcpcsvc6sresolvernsresolvera/sha1audulenttrustedtrusteda/sha1audulenttrustedsmart_japanese.langsmart_korean.langsmart_norwegian.langsmart_polish.langsmart_romanian.langsmart_russian.langsmart_serbian.langsmart_slovak.langsmart_slovenian.langsmart_spanish.langsmart_swedish.langsmart_turkish.langsmart_ukrainian.langburnsetdduninstarggaerrorcustomactiongacancelcustomactionprogrammenufoldermanufacturerfolderbudzfnur" - Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfewtzbnmeswstajbgurdgmcgguabbsde3gf41waic8uh9lf92%2bijqh5qwqumuusmv81lkgvkebccca2kvwxheycedpxckirqfmz4qw70zm5rw4%3d18e6b4a57a661cdf2d6d0d02_http://crl.sectigo.com/sectigopubliccodesigningrootr46.crlcrl.comodoca.com.cdn.cloudflare.netcrl.sectigo.comcrl.comodoca.com.cdn.cloudflare.netcrl.sectigo.comnumdisplaymonitorspcserverregisterhttp://ocsp.sectigo.com/mfewtzbnmeswstajbgurdgmcgguabbrd0jozuyxmqqw4y4zjtrlcmcrskaqugtksqssozubixklgkjks7eippxqcedkmbv7eakndjkthvt55q5i%3dondows\system32\msiexec.exethe" - Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found URL "http://ocsp.sectigo.comhttp://crl.sectigo.com/sectigopubliccodesigningcaevr36.crla" - Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found URL "http://www.microsoft.com04=mdf4m.d2d93&j/)si<" - Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found URL "http://crl.blicnotid]" - Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0/qi[0ub,6vzgac20l$thttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001936.00000001.314312.02460000.00000004.mdmp") Found URL "http://www.microsoft.com04=mdf4m.d2d93&j/)si<" - Source: "00000000-00001936.00000001.314312.02460000.00000004.mdmp") Found URL "http://ocsp.comodoca.comhttp://crl.comodoca.com/aaacertificateservices.crlen-usocal_machine\software\microsoft\windows\currentversion\installer\inprogress0;1;2;4;5;6;8;9;10;16;17;18;20;21;22;24;25;26;32;33;34;36;37;38;48;49;50;52;53;54foreign" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crlnc:\users\hapubws\appdata\roaming\microsoft\windows\start" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0or9iqmgvw,czc0?1$0" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n_wp" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0@zo:" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n;8kb%2+jo9v8!" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:;8kbm" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9entrust.net1;092www.entrust.net/cps" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?3bv:t6a[jr0m0]>-xgjus1!0the" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00001936.00000002.316238.001FC000.00000004.mdmp") Found URL "http://www.cleverfiles.com/contactsregaa28cb048d52ccc12c14bafb46457ac1rege30bbbe40513364248c294a61af1e6b4c:\users\hapubws\appdata\local\temp\%systemroot%\system32\shell32.dll,-21796c:\users\hapubws\appdata\roaming\%systemroot%\system32\shell32.dll,-21770%systemroot%\system32\shell32.dll,-21797%systemroot%\system32\shell32.dll,-12688%systemroot%\system32\shell32.dll,-21779%systemroot%\system32\shell32.dll,-21762%systemroot%\system32\shell32.dll,-21782%systemroot%\system32\shell32.dll,-21787%systemroot%\system32\shell32.dll,-21786%systemroot%\system32\shell32.dll,-21799%systemroot%\system32\shell32.dll,-21762%systemroot%\system32\shell32.dll,-21782%systemroot%\system32\shell32.dll,-21787%systemroot%\system32\shell32.dll,-21786%systemroot%\system32\shell32.dll,-21769alrpc:[ole4762469b271649278acd8127b732]microsoft.windowsapicodepack.dllsmart_simplified_chinese.langsmart_traditional_chinese.lang7hzy_qzh" - Source: "00000000-00001936.00000002.316238.010D5000.00000004.mdmp") Found URL "http://www.microsoft.com04=mdf4m.d2d93&j/)si<" - Source: "00000000-00001936.00000002.316238.010F2000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfewtzbnmeswstajbgurdgmcgguabbsde3gf41waic8uh9lf92%2bijqh5qwqumuusmv81lkgvkebccca2kvwxheycedpxckirqfmz4qw70zm5rw4%3ddatatextpathguidrootfileicon103320577601rinthoodocumentsnknown" - Source: "00000000-00001936.00000002.316238.0111C000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfewtzbnmeswstajbgurdgmcgguabbrd0jozuyxmqqw4y4zjtrlcmcrskaqugtksqssozubixklgkjks7eippxqcedkmbv7eakndjkthvt55q5i%3dos\publicsystemdrive=c:systemrothe" - Source: "00000000-00001936.00000002.316238.0111C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00001936.00000002.316238.0111C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001936.00000002.316238.0111C000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00001936.00000002.316238.0111C000.00000004.mdmp") Found URL "http://ocsp.sectigo.comhttp://crl.sectigo.com/sectigopubliccodesigningcaevr36.crlhkey_local_machine\software\microsoft\windows\currentversion\installer\rollback\scriptsownerorl.sectigo.com/sectigopubliccodesigningcaevr36.crlsequence" - Source: "00000000-00001936.00000002.316238.01142000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00001936.00000002.316238.01142000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0/qi[0ub,6vzgac20l$thttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001936.00000002.316238.02460000.00000004.mdmp") Found URL "http://www.microsoft.com04=mdf4m.d2d93&j/)si<" - Source: "00000000-00001936.00000002.316238.02460000.00000004.mdmp") Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%lskernel32.dll_:w@f:w:whu:wr'wq])w*g?cu(gcu" - Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0k^-" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningrootr46.crl0" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningrootr46.p7c0" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0k'lzqfav)s1" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "https://sectigo.com/cps0d0b0@:http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crl0" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningcaevr36.crt0" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0dus-delaware-7954709very@cleverfiles.com0/nc3xniw?" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "https://sectigo.com/cps0=0;093http://crl.sectigo.com/sectigorsatimestampingca.crl0th0f0?3http://crt.sectigo.com/sectigorsatimestampingca.crt0" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0tw$?" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0rrj;b7" - Source: "00000000-00002124.00000000.310751.02CC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0k^-" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningrootr46.crl0" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningrootr46.p7c0" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0k'lzqfav)s1" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "https://sectigo.com/cps0d0b0@:http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crl0" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningcaevr36.crt0" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0dus-delaware-7954709very@cleverfiles.com0/nc3xniw?" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "https://sectigo.com/cps0=0;093http://crl.sectigo.com/sectigorsatimestampingca.crl0th0f0?3http://crt.sectigo.com/sectigorsatimestampingca.crt0" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0tw$?" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0rrj;b7" - Source: "00000000-00002124.00000002.314598.02CC0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/3033929" - Source: "00000000-00002348.00000000.315798.002B0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/3033929-209235clsid\" - Source: "00000000-00002348.00000000.315798.002B0000.00000004.mdmp") Found URL "http://dokan-dev.github.io/>please" - Source: "00000000-00002348.00000000.315798.002B0000.00000004.mdmp") Found URL "http://wixtoolset.org/schemas/thmutil/2010" - Source: "00000000-00002348.00000000.315798.00FB0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/3033929" - Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/3033929-209235clsid\" - Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp") Found URL "http://dokan-dev.github.io/>please" - Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/3033929microsoft" - Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/3033929installation" - Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/3033929" - Source: "00000000-00002348.00000001.317721.03E50000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0j" - Source: "00000000-00002348.00000001.317721.03E50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00002348.00000001.317721.03E50000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00002348.00000001.317721.03E50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00002348.00000001.317721.03E50000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/3033929-209235clsid\" - Source: "00000000-00002348.00000002.318391.00302000.00000004.mdmp") Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%lskernel32.dll_:w@f:w:whu:wr'wq])w*g?cu(gcu" - Source: "00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found URL "https://support.microsoft.com/en-us/kb/2999226-209235clsid\" - Source: "00000000-00002756.00000000.309787.00240000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/2999226onnt64" - Source: "00000000-00002756.00000000.309787.00240000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/8ecb9800-52fd-432d-83ee-d6e037e96cc2/50a3e92ade4c2d8f310a2812d463224591040446bd" - Source: "00000000-00002756.00000000.309787.00240000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/2999226-209235clsid\" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/2999226onnt64" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigoeccdomainvalidationsecureserverca.crthttp://ocsp.sectigo.com\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\metadata\d0e1c4b6144e7ecab3f020e4a19efc29_*5fb3df55f6a1fe946987c264867a14:\program" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl:\windows\system32\crypt32.dll:\windows\system32\msasn1.dll:\windows\system32\mswsock.dll:\windows\system32\wship6.dll:\windows\system32\winnsi.dllle828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3:\windows\system32\msv1_0.dll:\windows\system32\nlaapi.dllle828a628afdc24f70a320194724c3:\windows\system32\wininet.dllle828a628afdc24f70a320194724c3ininetbroker.wininetbroker.1:\windows\system32\wininet.dllicrosoft" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbrttu9ufqgvghhjwxzywcnxmvr5ngquobekiz6w8qfs4q8p74klf9awplqcefznhqtqt5lmbxcbr1nsdzq%3dhttp://ocsp.sectigo.com/mfiwudbomewwsjajbgurdgmcgguabbtplnxcmeqnlivyh5vuz4lawhzx3qqu9oukoxgg4qr9dqollnluzgr7e64ceqcrzoa1ynvobzacezashkn1http://ocsp.usertrust.com/mfiwudbomewwsjajbgurdgmcgguabbsr83eyjy3njhjvpn5bepfc6mxawqquouejhttpgckwdnrjdtzgnczjy5oceqdzze5rbgbqi34jrr174fud22u132u" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "https://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/dokansetup.exehttps://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/dokansetup.exej" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "https://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/dokansetup.exeu" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigoeccdomainvalidationsecureserverca.crt0" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0ox*m]pa-%l" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrusteccaddtrustca.crt0%http://ocsp.usertrust.com0b" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9msq[=qms)e3=xvysn0vysn0034003000458007d00200060020006e0032l;003900340035u;pcury,7,1442acmg18" - Source: "00000000-00002756.00000001.311709.00240000.00000004.mdmp") Found URL "https://cleverfiles.com/help/eula" - Source: "00000000-00002756.00000001.311709.004B0000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/8ecb9800-52fd-432d-83ee-d6e037e96cc2/50a3e92ade4c2d8f310a2812d46322459104039b9deadbd7fdd483b5c697c0c8/vc_redist.x86.exe" - Source: "00000000-00002756.00000001.311709.004B0000.00000004.mdmp") Found URL "https://download.visualstudio.microsoft.com/download/pr/89a3b9df-4a09-492e-8474-8f92c115c51d/b1a32c71a6b7d5978904fb223763263ea5a7eb23b2c44a0d60e90d234ad99178/vc_redist.x64.exe" - Source: "00000000-00002756.00000001.311709.004B0000.00000004.mdmp") Found URL "https://download.visualstudrepairabledleinstalled]" - Source: "00000000-00002756.00000001.311709.004B0000.00000004.mdmp") Found URL "https://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/dokansetup.exefile:///c:/windows/temp/%7b9004b390-eb4b-4193-960e-6a06640d6f3e%7d/.ba/bootstrapperapplicationdata.xmloverridablenametdbaoverridablevariablefile:///c:/windows/temp/%7b9004b390-eb4b-4193-960e-6a06640d6f3e%7d/.ba/1033/thm.wxlcontrolinstalled" - Source: "00000000-00002756.00000001.311709.004B0000.00000004.mdmp") Found URL "http://wixtoolset.org/schemas/thmutil/2010" - Source: "00000000-00002756.00000001.311709.004B0000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrusteccaddtrustca.crthttp://ocsp.usertrust.comraudulentsa/sha1raudulentntrustedntrusted4b372709d6c2ad766c34d274501dc76_tartcom" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbrttu9ufqgvghhjwxzywcnxmvr5ngquobekiz6w8qfs4q8p74klf9awplqcefznhqtqt5lmbxcbr1nsdzq%3db2faf7692fd9ffbd64ede317e42334ba_http://crl.comodoca.com/aaacertificateservices.crlryptnet.dll:\windows\system32\cryptnet.dll2faf7692fd9ffbd64ede317e42334ba_0e1c4b6144e7ecab3f020e4a19efc29_csp:http://ocsp.sectigo.comttp://ocsp.usertrust.com/mfiwudbomewwsjajbgurdgmcgguabbsr83eyjy3njhjvpn5bepfc6mxawqquouejhttpgckwdnrjdtzgnczjy5oceqdzze5rbgbqi34jrr174fud?content-type:" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbrttu9ufqgvghhjwxzywcnxmvr5ngquobekiz6w8qfs4q8p74klf9awplqcefznhqtqt5lmbxcbr1nsdzq%3dbcomodo" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.usertrust.com/mfiwudbomewwsjajbgurdgmcgguabbsr83eyjy3njhjvpn5bepfc6mxawqquouejhttpgckwdnrjdtzgnczjy5oceqdzze5rbgbqi34jrr174fudd0e1c4b6144e7ecab3f020e4a19efc29_cryptimportkeyetdrivetypehttp://ocsp.usertrust.com/mfiwudbomewwsjajbgurdgmcgguabbsr83eyjy3njhjvpn5bepfc6mxawqquouejhttpgckwdnrjdtzgnczjy5oceqdzze5rbgbqi34jrr174fudetdrivetypeetdrivetypetion" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfiwudbomewwsjajbgurdgmcgguabbtplnxcmeqnlivyh5vuz4lawhzx3qqu9oukoxgg4qr9dqollnluzgr7e64ceqcrzoa1ynvobzacezashkn12-8b8d-2e5e1d522649??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649etdrivetyperedenumeratew:\0f78b09d-45b2-8b8d-2522649etdrivetypeetdrivetype/eventmfewtzbnmeswstajbgurdgmcgguabbrttu9ufqgvghhjwxzywcnxmvr5ngquobekiz6w8qfs4q8p74klf9awplqcefznhqtqt5lmbxcbr1nsdzq%3dgurdxmvr5ngquobekiz6w8qfs4q8p74klf9awplqcefznhqtqt5lmbxcbr1nsdzq%3dttp://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbrttu9ufqgvghhjwxzywcnxmvr5ngquobekiz6w8qfs4q8p74klf9awplqcefznhqtqt5lmbxcbr1nsdzq%3d/eventents/eventccessfully" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfiwudbomewwsjajbgurdgmcgguabbtplnxcmeqnlivyh5vuz4lawhzx3qqu9oukoxgg4qr9dqollnluzgr7e64ceqcrzoa1ynvobzacezashkn1olocal" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigoeccdomainvalidationsecureserverca.crt0" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0ox*m]pa-%l" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrusteccaddtrustca.crt0%http://ocsp.usertrust.com0b" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9ms?r<0" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9ms3lssruuukssmmje" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c/i9/-k" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^9ckxentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!)wp+(the" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!%2+jo;8kbentrust.net1;092www.entrust.net/cps" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,'0%0" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!-upmxsuuuhhsm1.3.6.1.5.5.7.48.21.3.6.1.5.5.7.48.1" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com00a0" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?2.5.gcmqc;com1" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crlahsmahsm2.5.29.32.0rldaprhttprfilerhttps2.5.4.62.5.4.82.5.4.72.5.4.10l0ykasyc8qtpqqqqqqqqqqqqqqqqimary" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crlsessi]tl241204180014z0/^g(o-cejy" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002756.00000001.311709.03520000.00000004.mdmp") Found URL "http://ocsp.comodoca.comhttp://crl.comodoca.com/aaacertificateservices.crlhttp://crl.usertrust.com/usertrustecccertificationauthority.crl:\users\gqdibyn\appdata\local\package" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "https://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/dokansetup.exe'" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/2999226-209235clsid\" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/2999226onnt64" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigoeccdomainvalidationsecureserverca.crthttp://ocsp.sectigo.com:\program" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfiwudbomewwsjajbgurdgmcgguabbtplnxcmeqnlivyh5vuz4lawhzx3qqu9oukoxgg4qr9dqollnluzgr7e64ceqcrzoa1ynvobzacezashkn1" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl:\windows\system32\crypt32.dll:\windows\system32\msasn1.dll:\windows\system32\mswsock.dll:\windows\system32\wship6.dll:\windows\system32\winnsi.dllle828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3:\windows\system32\msv1_0.dll:\windows\system32\nlaapi.dllle828a628afdc24f70a320194724c3:\windows\system32\wininet.dllle828a628afdc24f70a320194724c3ininetbroker.wininetbroker.1:\windows\system32\wininet.dllicrosoft" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigoeccdomainvalidationsecureserverca.crt0" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0ox*m]pa-%l" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrusteccaddtrustca.crt0%http://ocsp.usertrust.com0b" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9msq[=qms)e3=xvysn0vysndnsr0034003000458007d00200060020006e0032l;003900340035u;pcury,7,1442acmg18" - Source: "00000000-00002756.00000002.313634.00240000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl:\windows\system32\negoexts.dllshist012024030820240309:\windows\system32\wininet.dll:\windows\system32\schannel.dll4b372709d6c2ad766c34d274501dc76_igest" - Source: "00000000-00002756.00000002.313634.03520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00002756.00000002.313634.03520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002756.00000002.313634.03520000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00002756.00000002.313634.03520000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbrttu9ufqgvghhjwxzywcnxmvr5ngquobekiz6w8qfs4q8p74klf9awplqcefznhqtqt5lmbxcbr1nsdzq%3ditives.dll671794e4a156" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crt.usertrust.com/usertrusteccaddtrustca.crthttp://ocsp.usertrust.comndows\temp\" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl0e1c4b6144e7ecab3f020e4a19efc29_ryptnet.dll:\windows\system32\cryptnet.dll2faf7692fd9ffbd64ede317e42334ba_csp:http://ocsp.sectigo.comartcom" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbrttu9ufqgvghhjwxzywcnxmvr5ngquobekiz6w8qfs4q8p74klf9awplqcefznhqtqt5lmbxcbr1nsdzq%3dbcomodo" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://ocsp.usertrust.com/mfiwudbomewwsjajbgurdgmcgguabbsr83eyjy3njhjvpn5bepfc6mxawqquouejhttpgckwdnrjdtzgnczjy5oceqdzze5rbgbqi34jrr174fudmsiscanbufferpcbindingfreepcbindingfreemsiscanbufferetdrivetypecalrpc:[dnsresolver,security=impersonation" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p1<92a@ef" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c/i9/-k" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^9ckxentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!)wp+(the" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!%2+jo;8kbentrust.net1;092www.entrust.net/cps" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,'0%0" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!1.3.6.1.5.5.7.48.21.3.6.1.5.5.7.48.1-upnxsuuuhhsm" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com00a0" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?2.5.gcmqc;com1" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigoeccdomainvalidationsecureserverca.crt0" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0ox*m]pa-%l" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrusteccaddtrustca.crt0%http://ocsp.usertrust.com0b" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9ms)4ku]ceptceptlfordgz;" - Source: "00000000-00002756.00000002.313634.03532000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfiwudbomewwsjajbgurdgmcgguabbtplnxcmeqnlivyh5vuz4lawhzx3qqu9oukoxgg4qr9dqollnluzgr7e64ceqcrzoa1ynvobzacezashkn1olocal" - Source: "00000000-00002756.00000002.313634.035DA000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crldd.setup.x86.msixc:\users\gqdibyn\appdata\local\temp\disk_drill_4.5.616.0_20250322210059_003_dd.setup.x86.msi.logcert" - Source: "00000000-00002756.00000002.313634.035DA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00002756.00000002.313634.035DA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002756.00000002.313634.035DA000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00002756.00000002.313634.035DA000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0k^-" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningrootr46.crl0" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningrootr46.p7c0" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0k'lzqfav)s1" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "https://sectigo.com/cps0d0b0@:http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crl0" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningcaevr36.crt0" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0dus-delaware-7954709very@cleverfiles.com0/nc3xniw?" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "https://sectigo.com/cps0=0;093http://crl.sectigo.com/sectigorsatimestampingca.crl0th0f0?3http://crt.sectigo.com/sectigorsatimestampingca.crt0" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0tw$?" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0rrj;b7" - Source: "00000000-00002756.00000002.313634.04A20000.00000004.mdmp") Found URL "http://ocsp.comodoca.comhttp://crl.comodoca.com/aaacertificateservices.crlocsp:http://ocsp.comodoca.comhttp://crl.comodoca.com/aaacertificateservices.crl:\users\gqdibyn\appdata\local\package" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/2999226-209235clsid\" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "http://ocsp.usertrust.comhttp://crl.usertrust.com/usertrustecccertificationauthority.crl:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5\mshist012024030820240309\" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "https://support.microsoft.com/en-us/kb/2999226onnt64" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "http://ocsp.sectigo.com/mfiwudbomewwsjajbgurdgmcgguabbtplnxcmeqnlivyh5vuz4lawhzx3qqu9oukoxgg4qr9dqollnluzgr7e64ceqcrzoa1ynvobzacezashkn1" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl:\windows\system32\crypt32.dll:\windows\system32\msasn1.dll:\windows\system32\mswsock.dll:\windows\system32\wship6.dll:\windows\system32\winnsi.dllle828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3le828a628afdc24f70a320194724c3:\windows\system32\msv1_0.dll:\windows\system32\nlaapi.dllle828a628afdc24f70a320194724c3:\windows\system32\wininet.dllle828a628afdc24f70a320194724c3ininetbroker.wininetbroker.1:\windows\system32\wininet.dllicrosoft" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigoeccdomainvalidationsecureserverca.crt0" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0ox*m]pa-%l" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrusteccaddtrustca.crt0%http://ocsp.usertrust.com0b" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9msq[=qms)e3=xvysn0vysn?" - Source: "00000000-00002756.00000003.316314.00240000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigorsadomainvalidationsecureserverca.crt0" - Source: "00000000-00002756.00000003.316314.00DA0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0vqx$ox*m]pa-%lqb0" - Source: "00000000-00002756.00000003.316314.00DA0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002756.00000003.316314.00DA0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0or9iqmgvw,czc0?1$0" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl03.6.1.5.5.7.3.7p1<92a@ef" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0c/i9/-k" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^9ckxentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!)wp+(the" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!%2+jo;8kbentrust.net1;092www.entrust.net/cps" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,greater" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustecccertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrusteccaddtrustca.crt0%http://ocsp.usertrust.com0b" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9ms;v&o-upnxsuuuhhsm7tj\objects.githubusercontent.comlmem" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com00a0" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?2.5.gcmqc;com1" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigorsadomainvalidationsecureserverca.crt0" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0vqx$ox*m]pa-%lqb0" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com08f" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9msp*mw" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://objects.githubusercontent.com/github-production-release-asset-2e65be/27818365/953b9280-566f-11eb-9e0c-0f6be2ca1a64?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=releaseassetproduction%2f20250322%2fus-east-1%2fs3%2faws4_request&x-amz-date=20250322t210221z&x-amz-expires=300&x-amz-signature=12c4f356b231408b39cf9f21f5a87d4872d0028f4a95e29416da1dbbfa6c5010&x-amz-signedheaders=host&response-content-disposition=attachment%3b%20filename%3ddokansetup.exe&response-content-type=application%2foctet-streamcache-control:" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp:/" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.usertrust.com/us" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crt.use" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://ocsp.usertrust.com0" - Source: "00000000-00002756.00000003.316314.03520000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9ms" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9msgreater" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com03tv;(l3:9ms/h!h%!z>vpdigicert" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0;!%" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0j" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "https://sectigo.com/cps0x0v0ochttp://crt.sectigo.com/sectigorsadomainvalidationsecureserverca.crt0" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0vqx$ox*m]pa-%lqb0" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0k^-" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningrootr46.crl0" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningrootr46.p7c0" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0k'lzqfav)s1" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "https://sectigo.com/cps0d0b0@:http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crl0" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningcaevr36.crt0" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0dus-delaware-7954709very@cleverfiles.com0/nc3xniw?" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "https://sectigo.com/cps0=0;093http://crl.sectigo.com/sectigorsatimestampingca.crl0th0f0?3http://crt.sectigo.com/sectigorsatimestampingca.crt0" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0tw$?" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0rrj;b7" - Source: "00000000-00002756.00000003.316314.04A20000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00004380.00000000.316294.00090000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0wyw[iy>%!z>vpdigicert" - Source: "00000000-00004380.00000000.316294.00090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00004380.00000000.316294.00090000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0;!%" - Source: "00000000-00004380.00000000.316294.00090000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0j" - Source: "00000000-00004380.00000000.316294.00090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00004380.00000000.316294.00090000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00004380.00000001.318214.00090000.00000004.mdmp") Found URL "http://crl3.digicert.com/assured-cs-g1.crl00*http://crl4.digicert.com/assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0v0t0$http://ocsp.digicert.com0l@http://cacerts.digicert.com/digicertassuredidcodesigningca-1.crt0wyw[iy>%!z>vpdigicert" - Source: "00000000-00004380.00000001.318214.00090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00004380.00000001.318214.00090000.00000004.mdmp") Found URL "http://www.digicert.com/ssl-cps-repository.htm0m0k0$http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl3.digicert.com/digicertassuredidrootca.crl0:4http://crl4.digicert.com/digicertassuredidrootca.crl0;!%" - Source: "00000000-00004380.00000001.318214.00090000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0j" - Source: "00000000-00004380.00000001.318214.00090000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00004380.00000001.318214.00090000.00000004.mdmp") Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%lskernel32.dll_:w@f:w:whu:wr'wq])w*g?cu(gcu" - Source: "00000000-00004380.00000001.318214.00B0A000.00000002.mdmp") Found URL "http://appsyndication.org/2006/appsynapplicationupgradeexclusivetrueenclosuredigestalgorithmsha1sha256none%04hu-%02hu-%02hut%02hu:%02hu:%02huz%04hu-%02hu-%02hut%02hu:%02hu:%02hu%c%02u:%02uattributessoftware\classes\installer\dependencies\dependents%ls%ls\%ls\%ls%ls\%lskernel32.dll_:w@f:w:whu:wr'wq])w*g?cu(gcu" - Source: "00000000-00005028.00000000.309682.0103A000.00000002.mdmp")62:T132e,Found string "A+ncalrpc:[OLE4762469B271649278ACD8127B732]" (Indicator: "ncalrpc"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp") Found string "+ncalrpc:[OLE5A54105CD06B48FDB5B6518E2B4D]" (Indicator: "ncalrpc"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string "+ncalrpc:[OLE4762469B271649278ACD8127B732]" (Indicator: "ncalrpc"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00407000.00000004.mdmp") Found string "+ncalrpc:[OLE4762469B271649278ACD8127B732]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00407000.00000004.mdmp") Found string "+ncalrpc:[OLE0FD2E8E48B944214BC4C380EEBE2]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00407000.00000004.mdmp") Found string "+ncalrpc:[OLE650B93DEA79C45EB80D75BA33118]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00407000.00000004.mdmp") Found string "+ncalrpc:[OLE7E017A807A3D47FFB759084F438B]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00407000.00000004.mdmp") Found string "B+ncalrpc:[OLE0FD2E8E48B944214BC4C380EEBE2]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00430000.00000004.mdmp") Found string "B+ncalrpc:[OLE650B93DEA79C45EB80D75BA33118]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00430000.00000004.mdmp") Found string "+ncalrpc:[OLE828A628AFDC24F70A320194724C3]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp") Found string "+ncalrpc:[OLE828A628AFDC24F70A320194724p" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00430000.00000004.mdmp") Found string "+ncalrpc:[OLE5088DED266F947378DE0D34729D2]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp") Found string "+ncalrpc:[OLE5A54105CD06B48FDB5B6518E2B4D]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00407000.00000004.mdmp") Found string "B+ncalrpc:[OLE5A54105CD06B48FDB5B6518E2B4D]" (Indicator: "ncalrpc"; Source: "00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00430000.00000004.mdmp") Found string "+ncalrpc:[OLE000F1B74CC0F47E08F51D81D9A36]" (Indicator: "ncalrpc"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp")63:T409,"disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2f010dad" "cx": "16" "cy": "16"} "disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "12010d47" "cx": "1" "cy": "1"} "disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2b0106f6" "cx": "1" "cy": "1"} "disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "35010ca2" "cx": "420" "cy": "25"} "disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "91010cb2" "cx": "420" "cy": "25"} "disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2f010dad" "cx": "75" "cy": "23"} "disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "91010cb2" "cx": "75" "cy": "23"} "disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "35010ca2" "cx": "334" "cy": "15"} "disk-drill-win4.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "2f010dad" "cx": "334" "cy": "15"}64:T7cb,"disk-drill-win4.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\.cr\*.* (UID: 00000000-00005028) "disk-drill-win4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005028) "disk-drill-win4.exe" called "FindNextFileW" with parameter disk-drill-win4.exe (UID: 00000000-00005028) "disk-drill-win4.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{B5073109-9407-4E64-A6E5-671794E4A156}\*.* (UID: 00000000-00005028) "disk-drill-win4.exe" called "FindNextFileW" with parameter .cr (UID: 00000000-00005028) "disk-drill-win4.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1033\thm.wxl (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\1033\thm.xml (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.ba\thm.xml (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Package Cache\{a13977d2-381b-4fba-a79e-6b13b9beb784}\DiskDrillSetup.4.5.616.0.exe (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.be\*.* (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindNextFileW" with parameter DiskDrillSetup.4.5.616.0.exe (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindFirstFileW" with parameter C:\DokanSetup.1.4.1.1000.exe (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\DokanSetup.exe (UID: 00000000-00002756) "disk-drill-win4.exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\SystemCertificates\My\Certificates\* (UID: 00000000-00002756)65:T6ba,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "disk-drill-win4.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "disk-drill-win4.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "disk-drill-win4.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "disk-drill-win4.exe") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "disk-drill-win4.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "45726793226976,988,3118,,FindNextFileW,kernel32.dll,"253:10:15.310",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001936.00000001.314312.010D5000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "15147197845376,4888,3118,,FindNextFileW,kernel32.dll,"253:08:42.979",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp")66:Te3d,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "disk-drill-win4.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "disk-drill-win4.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "disk-drill-win4.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "disk-drill-win4.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "disk-drill-win4.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "disk-drill-win4.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp, 00000000-00001936.00000002.316238.01112000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp, 00000000-00001936.00000002.316238.01112000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")67:Tc6f,Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "disk-drill-win4.exe") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "disk-drill-win4.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "disk-drill-win4.exe") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "disk-drill-win4.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "disk-drill-win4.exe") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")68:T671,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "disk-drill-win4.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "disk-drill-win4.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "disk-drill-win4.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")69:Tf3f,Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "disk-drill-win4.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "disk-drill-win4.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "disk-drill-win4.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "disk-drill-win4.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "disk-drill-win4.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "disk-drill-win4.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "disk-drill-win4.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "disk-drill-win4.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "disk-drill-win4.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")6a:T787,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "disk-drill-win4.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "disk-drill-win4.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "disk-drill-win4.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "40,3210,,LookupAccountSidW,a" (Indicator: "LookupAccountSid"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp")6b:Td20,Found string "Failed to allocate pipe secret." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Failed to write secret length to pipe." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Failed to write secret to pipe." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Failed to read size of verification secret from parent pipe." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Verification secret from parent is too big." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Failed to allocate buffer for verification secret." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Failed to read verification secret from parent pipe." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Verification secret from parent does not match." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Failed to copy connection secret from command line." (Indicator: "secret"; File: "disk-drill-win4.exe") Found string "Failed to set download password." (Indicator: "password"; File: "disk-drill-win4.exe") Found string "Failed to allocate pipe secret." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to write secret length to pipe." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to write secret to pipe." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to read size of verification secret from parent pipe." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Verification secret from parent is too big." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to allocate buffer for verification secret." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to read verification secret from parent pipe." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Verification secret from parent does not match." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to copy connection secret from command line." (Indicator: "secret"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to set download password." (Indicator: "password"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found string "Failed to allocate pipe secret." (Indicator: "secret"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string "Failed to write secret length to pipe." (Indicator: "secret"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string "Failed to write secret to pipe." (Indicator: "secret"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string "Failed to read size of verification secret from parent pipe." (Indicator: "secret"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found string "Verification secret from parent is too big." (Indicator: "secret"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")6c:T16fe,Found string "%WINDIR%\System32\Drivers\dokan1.sys" (Indicator: "\drivers\"; Source: "00000000-00002756-00000C29-3850436108") Found string "%WINDIR%\System32\Drivers\dokan1.sys" (Indicator: "system32\drivers"; Source: "00000000-00002756-00000C29-3850436108") Found string "\Device\HarddiskVolume2\ProgramData\Package Cache\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\DokanSetup.1.4.1.1000.exe" (Indicator: "\Device\"; Source: "00000000-00000336.00000000.315653.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\{9004B390-EB4B-4193-960E-6A06640D6F3E}\.be\DiskDrillSetup.4.5.616.0.exe" (Indicator: "\Device\"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp") Found string "WindowsFolder]System32\Drivers\dokan1.sys" (Indicator: "\drivers\"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp") Found string "WindowsFolder]System32\Drivers\dokan1.sys" (Indicator: "system32\drivers"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{dcbfaac4-d863-11e7-b9ff-806e6f6e6963}" (Indicator: "\Device\"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00430000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{dcbfaac4-d863-11e7-b9ff-806e6f6e6963}" (Indicator: "\DosDevices\"; Source: "00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00430000.00000004.mdmp") Found string "dowsFolder]System32\Drivers\dokan1.sys" (Indicator: "\drivers\"; Source: "00000000-00002124.00000003.318491.003F5000.00000004.mdmp") Found string "dowsFolder]System32\Drivers\dokan1.sys" (Indicator: "system32\drivers"; Source: "00000000-00002124.00000003.318491.003F5000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\{10423C26-E71D-44B2-B629-F7E289357C3C}\.cr\DokanSetup.1.4.1.1000.exe" (Indicator: "\Device\"; Source: "00000000-00002348.00000000.315798.002B0000.00000004.mdmp, 00000000-00002348.00000001.317721.002B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp, 00000000-00002348.00000002.318391.00302000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp, 00000000-00002348.00000002.318391.00302000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp, 00000000-00002348.00000002.318391.00302000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp, 00000000-00002348.00000002.318391.00302000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp, 00000000-00002348.00000002.318391.00302000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002348.00000001.317721.002B0000.00000004.mdmp, 00000000-00002348.00000002.318391.00302000.00000004.mdmp")6d:T8c1,Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "disk-drill-win4.exe") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "disk-drill-win4.exe") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; File: "disk-drill-win4.exe") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "WRPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00001936.00000000.312392.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")6e:T879,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "disk-drill-win4.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "disk-drill-win4.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "disk-drill-win4.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "disk-drill-win4.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "1088,988,3180,,AdjustTokenPrivileges,advapi32.dll,"253:10:20.801",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001936.00000002.316238.0111C000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp")6f:Tedc,Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "disk-drill-win4.exe") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "disk-drill-win4.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "disk-drill-win4.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "disk-drill-win4.exe") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; File: "disk-drill-win4.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "disk-drill-win4.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "disk-drill-win4.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "disk-drill-win4.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "disk-drill-win4.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "disk-drill-win4.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "disk-drill-win4.exe") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "SetEntriesInAclA" (Indicator: "SetEntriesInAcl"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp")70:T674,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "disk-drill-win4.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "disk-drill-win4.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "disk-drill-win4.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001936.00000001.314312.008D1000.00000020.mdmp, 00000000-00001936.00000002.316238.01112000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")71:Tbdc,"disk-drill-win4.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\VSSAPIPUBLISHER"; Key: "IDENTIFY (ENTER)"; Value: "4000000000000000C74860ACB69BDB014C08000038090000E80300000100000000000000000000009D559FFA264278489F179491DBC2DFE50000000000000000"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\VSSAPIPUBLISHER"; Key: "IDENTIFY (LEAVE)"; Value: "40000000000000008A99C1F3B69BDB014C08000038090000E80300000000000000000000022304809D559FFA264278489F179491DBC2DFE50000000000000000"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SPP"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SYSTEMRESTORE"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SYSTEMRESTORE"; Key: "SRCREATERP (ENTER)"; Value: "4000000000000000C5199F75659BDB014C080000D40A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SPP"; Key: "SPPCREATE (ENTER)"; Value: "4000000000000000257BA175659BDB014C080000D40A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SPP"; Key: "SPPGATHERWRITERMETADATA (ENTER)"; Value: "40000000000000008E8B39BD659BDB014C080000D40A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SPP"; Key: "SPPGATHERWRITERMETADATA (LEAVE)"; Value: "40000000000000009F250070669BDB014C080000D40A0000D3070000010000000000000015230480000000000000000000000000000000000000000000000000"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SPP"; Key: "SPPCREATE (LEAVE)"; Value: "40000000000000009F250070669BDB014C080000D40A0000D007000001000000000000001523048050C8799A73361D449647CD58132197790000000000000000"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SYSTEMRESTORE"; Key: "SRCREATERP (LEAVE)"; Value: "40000000000000009F250070669BDB014C080000D40A0000D5070000010000000000000015230480000000000000000000000000000000000000000000000000"), "DiskDrillSetup.4.5.616.0.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SYSTEMRESTORE"; Key: "SRCREATERP (ENTER)"; Value: "4000000000000000C4735541B69BDB014C080000D40A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000")72:T8ca,"disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "disk-drill-win4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")73:T419,Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "disk-drill-win4.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "disk-drill-win4.exe") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00000336.00000000.315653.0109A000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00002124.00000000.310751.00D2A000.00000002.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp")74:Ta24,Dropped file: "07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D]- [targetUID: 00000000-00002756] Dropped file: "B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25]- [targetUID: 00000000-00002756] Dropped file: "D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90]- [targetUID: 00000000-00002756] Dropped file: "892BD135CF0BA5A31C6B8A7554540845" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\892BD135CF0BA5A31C6B8A7554540845]- [targetUID: 00000000-00002756] Dropped file: "572BF21E454637C9F000BE1AF9B1E1A9" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9]- [targetUID: 00000000-00002756] Dropped file: "07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D]- [targetUID: 00000000-00002756] Dropped file: "B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25]- [targetUID: 00000000-00002756] Dropped file: "D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90]- [targetUID: 00000000-00002756] Dropped file: "D9CA54E0FA212456E1DB00704A97658E" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\D9CA54E0FA212456E1DB00704A97658E]- [targetUID: 00000000-00002756] Dropped file: "892BD135CF0BA5A31C6B8A7554540845" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\892BD135CF0BA5A31C6B8A7554540845]- [targetUID: 00000000-00002756] Dropped file: "572BF21E454637C9F000BE1AF9B1E1A9" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9]- [targetUID: 00000000-00002756] Dropped file: "D9CA54E0FA212456E1DB00704A97658E" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\D9CA54E0FA212456E1DB00704A97658E]- [targetUID: 00000000-00002756]75:T42c,"disk-drill-win4.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "disk-drill-win4.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "disk-drill-win4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "disk-drill-win4.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "disk-drill-win4.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "DokanSetup.1.4.1.1000.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "DokanSetup.1.4.1.1000.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")76:T51d,Spawned process "disk-drill-win4.exe" (UID: 00000000-00005028) Spawned process "disk-drill-win4.exe" with commandline "-burn.clean.room="C:\\disk-drill-win4.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188" (UID: 00000000-00002756) Spawned process "DiskDrillSetup.4.5.616.0.exe" with commandline "-q -burn.elevated BurnPipe.{D25F2013-007E-4FD2-9CA0-AA2EFF12545E} {6A5427E6-FB43-47F5-BB5F-022895AC4F9D} 2756" (UID: 00000000-00002124) Spawned process "DokanSetup.1.4.1.1000.exe" with commandline "/norestart /quiet /install -burn.filehandle.self=500 -burn.embedded BurnPipe.{7B27780B-0B1C-479B-9776-AA4616B328C9} {6F1DD431-BB43-4428-B84B-144817B1EC86} 2124" (UID: 00000000-00000336) Spawned process "DokanSetup.1.4.1.1000.exe" with commandline "-burn.clean.room="%ALLUSERSPROFILE%\\Package Cache\\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\\DokanSetup.1.4.1.1000.exe" -burn.filehandle.attached=176 -burn.filehandle.self=184 /norestart /quiet /install -burn.filehandle.self=500 -burn.embedded BurnPipe.{7B27780B-0B1C-479B-9776-AA4616B328C9} {6F1DD431-BB43-4428-B84B-144817B1EC86} 2124" (UID: 00000000-00002348) Spawned process "DokanSetup.exe" with commandline "-q -burn.elevated BurnPipe.{39776088-EBC0-4BED-9240-DAD20CA1C2C8} {2A175EA1-28FE-4196-A4FC-826F4542A205} 2348" (UID: 00000000-00004380)77:T523,GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007584-27997-1091-010BE513 GetLocalTime@KERNEL32.DLL at 00000000-00007584-27997-176-010CFDC2 GetLocalTime@KERNEL32.DLL at 00000000-00007584-27997-576-01092DE0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007584-27997-570-010D5BBF GetSystemTime@KERNEL32.DLL at 00000000-00007584-27997-1148-01095F14 GetSystemTime@KERNEL32.DLL at 00000000-00007584-27997-952-010D858F GetSystemTime@KERNEL32.DLL at 00000000-00001904-51479-631-013B864E GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001904-51479-873-013A7516 GetLocalTime@KERNEL32.DLL at 00000000-00001904-51479-633-013B26A0 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001904-51479-787-013AA39F GetSystemTime@KERNEL32.DLL at 00000000-00001904-51479-835-013898DB GetLocalTime@KERNEL32.DLL at 00000000-00001904-51479-59-013AF805 GetSystemTime@KERNEL32.DLL at 00000000-00002384-911-631-013B864E GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002384-911-787-013AA39F GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002384-911-873-013A7516 GetSystemTime@KERNEL32.DLL at 00000000-00002384-911-835-013898DB GetLocalTime@KERNEL32.DLL at 00000000-00002384-911-633-013B26A0 GetLocalTime@KERNEL32.DLL at 00000000-00002384-911-59-013AF805 GetSystemTime@KERNEL32.dll at 11343-1416-00405F1478:T4ac,Found API call GetLocalTime@KERNEL32.DLL directly followed by "cmp eax, E0000000h" and "je 010CFE5Dh" at 00000000-00007584-27997-176-010CFDC2 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-0000011Ch], edx" and "jne 010D3A43h" at 00000000-00007584-27997-700-010D39CD Found API call GetLocalTime@KERNEL32.DLL directly followed by "cmp cx, word ptr [eax]" and "je 013B27FFh" at 00000000-00001904-51479-633-013B26A0 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-0000011Ch], 04h" and "jne 013B6A61h" at 00000000-00001904-51479-372-013B69E2 Found API call GetLocalTime@KERNEL32.DLL directly followed by "cmp esi, E0000000h" and "je 013AF8A6h" at 00000000-00001904-51479-59-013AF805 Found API call GetLocalTime@KERNEL32.DLL directly followed by "cmp cx, word ptr [eax]" and "je 013B27FFh" at 00000000-00002384-911-633-013B26A0 Found API call GetLocalTime@KERNEL32.DLL directly followed by "cmp esi, E0000000h" and "je 013AF8A6h" at 00000000-00002384-911-59-013AF805 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-0000011Ch], 04h" and "jne 013B6A61h" at 00000000-00002384-911-372-013B69E279:T4ad,Sleep@KERNEL32.DLL at 00000000-00007584-27997-576-01092DE0 Sleep@KERNEL32.DLL at 00000000-00007584-27997-330-010D3FE7 Sleep@KERNEL32.DLL at 00000000-00007584-27997-969-010A4933 Sleep@KERNEL32.DLL at 00000000-00007584-27997-1047-010944E9 Sleep@KERNEL32.DLL at 00000000-00007584-27997-882-010D41D1 Sleep@KERNEL32.DLL at 00000000-00007584-27997-948-010A3E47 Sleep@KERNEL32.DLL at 00000000-00007584-27997-751-010A52E3 Sleep@KERNEL32.DLL at 00000000-00007584-27997-764-010A8AA3 Sleep@KERNEL32.DLL at 00000000-00007584-27997-895-010D54F8 Sleep@KERNEL32.DLL at 00000000-00001904-51479-423-013B6090 Sleep@KERNEL32.DLL at 00000000-00001904-51479-650-013838BE Sleep@KERNEL32.DLL at 00000000-00001904-51479-414-01382BC3 Sleep@KERNEL32.DLL at 00000000-00001904-51479-604-013AC677 Sleep@KERNEL32.DLL at 00000000-00001904-51479-553-013B61D6 Sleep@KERNEL32.DLL at 00000000-00001904-51479-627-01391F8A Sleep@KERNEL32.DLL at 00000000-00001904-51479-633-013B26A0 Sleep@KERNEL32.DLL at 00000000-00001904-51479-42-013AC5E6 Sleep@KERNEL32.DLL at 00000000-00001904-51479-435-013994F3 Sleep@KERNEL32.DLL at 00000000-00001904-51479-26-013AC62B Sleep@KERNEL32.DLL at 00000000-00001904-51479-566-013B010B7a:T1bf3,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base64 string in header "comodoca" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com"7b:T700,"msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\CAPABILITIES"; Key: "HIDDEN"; Value: "")7c:Tfb6,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1708 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 29 Mar 2024 08:43:27 GMT Last-Modified: Fri 29 Mar 2024 08:14:59 GMT Server: ECAcc (sac/251E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041445EBA2AFF492CB82312D518BA7A7219DF36DC80F180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3770 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 29 Mar 2024 08:43:28 GMT Last-Modified: Fri 29 Mar 2024 07:40:38 GMT Server: ECAcc (sac/2554) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145AC4B97B2A0AA3A5EA7103C060F92DF665750E58180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.comodoca.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 Mar 2024 08:43:36 GMT Content-Type: application/ocsp-response Content-Length: 1453 Connection: keep-alive Last-Modified: Wed 27 Mar 2024 09:13:41 GMT Expires: Wed 03 Apr 2024 09:13:40 GMT Etag: "1c41a871bd2230fc2b9342c5616d2b76fa112b81" Cache-Control: max-age=603964 s-maxage=1800 public no-transform must-revalidate X-CCACDN-Proxy-ID: scdpinlb4 X-Frame-Options: SAMEORIGIN CF-Cache-Status: HIT Age: 1467 Accept-Ranges: bytes Server: cloudflare CF-RAY: 86be92c3a97cfa86-SJC with response body ==>308205A90A0100A08205A23082059E06092B06010505073001010482058F3082058B30819EA21604146DBBD4E59297B37A3901240FF53BDF1C9DFBAAB6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.sectigo.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 Mar 2024 08:43:37 GMT Content-Type: application/ocsp-response Content-Length: 765 Connection: keep-alive Last-Modified: Tue 26 Mar 2024 06:56:28 GMT Expires: Tue 02 Apr 2024 06:56:27 GMT Etag: "39517172b7cca72c7b41c86c896551b7cfbfb6e8" Cache-Control: max-age=603520 s-maxage=1800 public no-transform must-revalidate X-CCACDN-Proxy-ID: scdpinlb6 X-Frame-Options: SAMEORIGIN CF-Cache-Status: HIT Age: 990 Accept-Ranges: bytes Server: cloudflare CF-RAY: 86be92c53fba15c6-SJC with response body ==>308202F90A0100A08202F2308202EE06092B0601050507300101048202DF308202DB3081C4A216041432EB929AFF3596482F284042702036915C1785E6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.sectigo.com" Response ==> HTTP/1.1 200 OK Date: Fri 29 Mar 2024 08:43:37 GMT Content-Type: application/ocsp-response Content-Length: 637 Connection: keep-alive Last-Modified: Tue 26 Mar 2024 08:29:59 GMT Expires: Tue 02 Apr 2024 08:29:58 GMT Etag: "db4db2faf764a76f0c010ecc83f9ec42913d71ed" Cache-Control: max-age=603538 s-maxage=1800 public no-transform must-revalidate X-CCACDN-Proxy-ID: scdpinlb4 X-Frame-Options: SAMEORIGIN CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Server: cloudflare CF-RAY: 86be92c6b8b815c6-SJC with response body ==>308202790A0100A08202723082026E06092B06010505073001010482025F3082025B3081C4A2160414813292412B28CD46C8C4A2C62A3912EC48A93F14180F32.......7d:T981,"msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\sample\memfs\dokan_memfs.vcxproj" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\x86\sample\memfs\dokan_memfs.vcxproj" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\sample\mirror\dokan_mirror.vcxproj" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\x86\sample\mirror\dokan_mirror.vcxproj" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\dokanctl.exe" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\sample\fuse_mirror\cygdokanfuse1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\x86\sample\fuse_mirror\cygdokanfuse1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\dokan1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\cygdokanfuse1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\dokanfuse1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\lib\dokanfuse1.lib" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\sample\fuse_mirror\dokan1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\x86\sample\fuse_mirror\dokan1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\libdokanfuse1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\dokanfuse1.pdb" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\x86\lib\dokanfuse1.lib" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\x86\dokanfuse1.pdb" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\include\dokan\dokan.h" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\lib\dokan1.lib" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\sample\memfs\dokan1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\x86\sample\memfs\dokan1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\sample\mirror\dokan1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\x86\sample\mirror\dokan1.dll" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\lib\dokannp1.lib" "msiexec.exe" touched file "C:\Program Files\Dokan\Dokan Library-1.4.1\dokannp1.pdb"7e:Ta75,"msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "e449d9d0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "e449eb10" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "msiexec.exe" called "WinHttpSendRequest" with parameters {"hRequest": "e449ef60" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a96fc5f0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "aid=ddwin%20%2F%20free&aip=1&an=DiskDrillWin&av=4.5.616.0&ci=ddwin&cid=10961464201075203081&cm=free&cn=DiskDrillWin%20%20free&cs=DiskDrillWin%20%204.5.616.0%20%20ddwin&dp=%2FSoftMeter%2FDiskDrillWin%2FInstall&ds=SoftMeter%20PRO%20v1.4.2&sr=1280x800&t=pageview&" "dwOptionalLength": "372" "dwTotalLength": "372" "dwContext": "2842575328"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a9709080" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "aid=ddwin%20%2F%20free&aip=1&an=DiskDrillWin&av=4.5.616.0&ci=ddwin&cid=10961464201075203081&cm=free&cn=DiskDrillWin%20%20free&cs=DiskDrillWin%20%204.5.616.0%20%20ddwin&ds=SoftMeter%20PRO%20v1.4.2&ea=DiskDrillWin%20Install&ec=DiskDrillWin%20events&el=Install&ev" "dwOptionalLength": "398" "dwTotalLength": "398" "dwContext": "3283589072"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "96aee950" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "aid=ddwin%20%2F%20free&aip=1&an=DiskDrillWin&av=4.5.616.0&ci=ddwin&cid=10961464201075203081&cm=free&cn=DiskDrillWin%20%20free&cs=DiskDrillWin%20%204.5.616.0%20%20ddwin&dp=%2FSoftMeter%2FDiskDrillWin%2FInstall&ds=SoftMeter%20PRO%20v1.4.2&sr=1280x800&t=pageview&" "dwOptionalLength": "372" "dwTotalLength": "372" "dwContext": "2527932960"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b0f68560" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "aid=ddwin%20%2F%20free&aip=1&an=DiskDrillWin&av=4.5.616.0&ci=ddwin&cid=10961464201075203081&cm=free&cn=DiskDrillWin%20%20free&cs=DiskDrillWin%20%204.5.616.0%20%20ddwin&ds=SoftMeter%20PRO%20v1.4.2&ea=DiskDrillWin%20Install&ec=DiskDrillWin%20events&el=Install&ev" "dwOptionalLength": "398" "dwTotalLength": "398" "dwContext": "2968715504"}7f:T116d,GET /dokan-dev/dokany/releases/download/v1.4.1.1000/DokanSetup.exe HTTP/1.1Accept: */* User-Agent: Burn Host: github.com Connection: Keep-Alive Cache-Control: no-cache GET /github-production-release-asset-2e65be/27818365/953b9280-566f-11eb-9e0c-0f6be2ca1a64?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240329T084308Z&X-Amz-Expires=300&X-Amz-Signature=d724c8a49fea8f99bfe30f0f11609b15341f13bf7957893c5db182598e672795&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=27818365&response-content-disposition=attachment%3B%20filename%3DDokanSetup.exe&response-content-type=application%2Foctet-stream HTTP/1.1Accept: */* User-Agent: Burn Connection: Keep-Alive Cache-Control: no-cache Host: objects.githubusercontent.com GET /exp017/a5766fee-9478-488b-9fc0-64d1ad72c290-WindowsServices_Evoke/api/v1/tas HTTP/1.1Host: default.exp-tas.com Cache-Control: no-store no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.22621.0 X-WINNEXT-APPVERSION: 1.23092.158.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {fe4289f0-6a0d-44ad-a249-527db813dcb0} X-WINNEXT-PUBDEVICEID: 36UTaMR5Mra1jEiOuip2QXJy2Ns7hzfP7l3bgBCDSdI= If-None-Match: 1814394662_1960059244 Accept-Encoding: gzip deflate br GET /v9.0/devicequalificationoffers?market=US&&locale=en-US&architecture=x64&moId=Public&oemId=Public&scmId=Public&hardware=arm0%2Carm640%2Cble0%2Ccmb0%2Ccmf0%2Ccmr0%2Cdcb1%2Cdcc1%2Cdx91%2Cdxa1%2Cdxb1%2Cgyr0%2Chce0%2Chdc0%2Chov0%2Chsa0%2Chss1%2Ckbd1%2Cm041%2Cm060%2Cm080%2Cm120%2Cm160%2Cm200%2Cm301%2Cm751%2CmA01%2Cmct0%2Cmgn0%2Cmic0%2Cmrc0%2Cmse1%2CmT01%2Cnfc0%2Crs10%2Crs20%2Crs30%2Crs40%2Crs50%2Crs60%2Ctch0%2Ctel0%2Cv010%2Cv020%2Cv040%2Cx641%2Cx860%2Cx86a640%2Cxbd0%2Cxbo0%2Cxbs0%2Cxbx0%2Cxgp0&packageHardware=dcb%2Cdcc%2Cdx9%2Cdxa%2Cdxb%2Cm30%2Cm75%2CmA0%2CmT0&deviceFamily=Windows.Desktop&catalogLocales=en-US&pageSize=5&cardsEnabled=true HTTP/1.1Accept-Encoding: gzip deflate Accept: */* TASIGNORE: YES MS-PreciseDeviceFamilyVersion: 2814751249598118 User-Agent: WindowsStore/22310.1401.8.0 MS-CV: Y4uqbBwNaE66nwD3bkifPQ.2 Accept-Language: en-US Authorization: Bearer MSAHW1.0=t=EwCoBF8iAQAUxokDaR6V1OYTSqu3AJSFH2TqWh0AAWgdOQxuZWyDH5bsQu9XTG84e+VWrMHmmcBcgsBxgXZO3DuxgjSeS0BRY666wE5yK8cT0dUTVg8sV5xJ0SPq6zt9k0VXBz+1tNnrSHBKHwx2Kx6WI9PHEvBZ4h7CBrP1B8lSExCZuOjjMtK/ZICh1p5/PLTthDW5WNr/jO4DAbSMEfi4LpFr5VEUWzPh+gQZ4Oow0m8QpPVCmlMvgwmQ+lGepoENHlPPtZsxnScKQn8Vbo35iYwLm2wQFTj/1NaQkAJd6vqscGglBs6xg3T/KD6gJko8HJ6bfE+TSVCv6B/0M1cxCDvFk2bmD/HrOO6+wRwNS2b1cYHxjeDkT9oWZUIDZgAACFZUohTdCmmReAPTlxcRsLx5xXt0G8M2cJ8EHIKAHcxqVGBtPa6VpzxXWTELb5V/TnAEuWAVXwQy5p6tw190u7bixTcGt7d1yEAP7S19+EqjaawmCcYnE+7Z0Qw8O8gvjeWuWQoAjmRqr2Wey2O2qj+qShvOxiSqA2JG9wPBONVtS9yny3XvMoQGmHDK936gVbWajHa/SOLOgVxMrQX7qWVGLDuz2DP1uo/848WddnQlfTbjmTtDqvqAW/xleMgHto6kFOrh9rSrTEa+7YY1dnSDbDro/hqWiTSXagSqZwkXClXNAafNArs7Tp/+m6jYnAZG2bRkFUwtmuqtXLdzTexkTWwTRSaZWvReVyjfwCVVkwL+mAJ4RyFuIW3xZrPEkoZ//WTf/j/5yFI1r1fB14xvIQClXoWrUR+neUO/177LcS74JdaFwfE1GoOeEcrNaCaTLmNYVMekGXGBVzfr0wXjPncOWGA+dmz+M6KG9XQPpttsB14js3+DYFnXuy3ZI/ahB9Wi6j3L4fJgRjIuvCKMKFGxv20byx2qQDeMMu4B7lyT8nU0myfSBLOTnaj36z3J8GXTUwu35LGL5yoxsRrE3NNjD63x1BGGYqm0ze0c4GKFF/WaiwMCp/ASAHQw0pidqt99jpDzitNJTmx1zT1LXXhfzIFzraQetctD3QKchdZncinlpTAVRYCD0V/lC8ckFYbMvKTMuv5gxqgZ7fgTdNhDenVLWOms4qQzml9cM02xY3GMb78XuYpaOSH9S6r0M2X2H91AO5fPF0X4+22LUyjcJ4TEFW2aVCXG+ui/zG7HvNDngkY2YbJzyVl02Pxhjxm3ULv9ky7y/AAEe+cWD17NBD8HniUjitx0g1j/oQvQfRQzqqfvMe5y1tZgCPS+/mdE+WA5F4CFBzwruOx9GyfN6a/w+odOL0qGr/wvScq/VFHD26AwxBeqj+bgohfztD6j2VNz1XP+ad5vNBkFXVpLKVp41rREBKxjysd5F8fZsy3OctGFo3apXDtzP3pQFlSq2ejEqzjEG1drVNA8uf+3E3mv5vSB9o8e+5kpgOGN9QO57s1QaLyKGEbJmR+jMT2aFsnHf+/1+0Zj5Rd3Ze3rauCXglEStCJptkM2R1KWlWCXhdCjQHGU+ZnlPo/SjtXn/JuUqDYKYWH6peYnLGMgjc0D1BHAfju6RC35YfCdAw==&p= Content-Length: 0 Content-Type: application/json; charset=UTF-8 Host: storeedgefd.dsx.mp.microsoft.com Connection: Keep-Alive Cache-Control: no-cache GET /v9.0/oemdiscovery?oemId=&scmId=&phoneManufacturerName=&smBiosManufacturerName=3kL1se945&phoneDeviceModel=&smBiosDm=AKQK79S92iI HTTP/1.1Accept-Encoding: gzip deflate Accept: */* TASIGNORE: YES MS-PreciseDeviceFamilyVersion: 2814751249598118 User-Agent: WindowsStore/22310.1401.8.0 MS-CV: Y4uqbBwNaE66nwD3bkifPQ.1 Accept-Language: en-US Host: storeedgefd.dsx.mp.microsoft.com Connection: Keep-Alive 80:Te41,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3x" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base62 string in header "U9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base62 string in header "6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZS" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.comodoca.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kV" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQS" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "sozUbIxKLGKjkS7EipPxQCEDkmbV7eakn" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com"81:T9aa,Found HTTPS HEAD request to https://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/DokanSetup.exe Found HTTPS HEAD request to https://objects.githubusercontent.com/github-production-release-asset-2e65be/27818365/953b9280-566f-11eb-9e0c-0f6be2ca1a64?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240329T084308Z&X-Amz-Expires=300&X-Amz-Signature=d724c8a49fea8f99bfe30f0f11609b15341f13bf7957893c5db182598e672795&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=27818365&response-content-disposition=attachment%3B%20filename%3DDokanSetup.exe&response-content-type=application%2Foctet-stream Found HTTPS GET request to https://github.com/dokan-dev/dokany/releases/download/v1.4.1.1000/DokanSetup.exe Found HTTPS GET request to https://objects.githubusercontent.com/github-production-release-asset-2e65be/27818365/953b9280-566f-11eb-9e0c-0f6be2ca1a64?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240329%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240329T084308Z&X-Amz-Expires=300&X-Amz-Signature=d724c8a49fea8f99bfe30f0f11609b15341f13bf7957893c5db182598e672795&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=27818365&response-content-disposition=attachment%3B%20filename%3DDokanSetup.exe&response-content-type=application%2Foctet-stream Found HTTPS POST request to https://www.google-analytics.com/collect Found HTTPS GET request to https://default.exp-tas.com/exp017/a5766fee-9478-488b-9fc0-64d1ad72c290-WindowsServices_Evoke/api/v1/tas Found HTTPS GET request to https://storeedgefd.dsx.mp.microsoft.com/v9.0/devicequalificationoffers?market=US&&locale=en-US&architecture=x64&moId=Public&oemId=Public&scmId=Public&hardware=arm0%2Carm640%2Cble0%2Ccmb0%2Ccmf0%2Ccmr0%2Cdcb1%2Cdcc1%2Cdx91%2Cdxa1%2Cdxb1%2Cgyr0%2Chce0%2Chdc0%2Chov0%2Chsa0%2Chss1%2Ckbd1%2Cm041%2Cm060%2Cm080%2Cm120%2Cm160%2Cm200%2Cm301%2Cm751%2CmA01%2Cmct0%2Cmgn0%2Cmic0%2Cmrc0%2Cmse1%2CmT01%2Cnfc0%2Crs10%2Crs20%2Crs30%2Crs40%2Crs50%2Crs60%2Ctch0%2Ctel0%2Cv010%2Cv020%2Cv040%2Cx641%2Cx860%2Cx86a640%2Cxbd0%2Cxbo0%2Cxbs0%2Cxbx0%2Cxgp0&packageHardware=dcb%2Cdcc%2Cdx9%2Cdxa%2Cdxb%2Cm30%2Cm75%2CmA0%2CmT0&deviceFamily=Windows.Desktop&catalogLocales=en-US&pageSize=5&cardsEnabled=true Found HTTPS GET request to https://storeedgefd.dsx.mp.microsoft.com/v9.0/oemdiscovery?oemId=&scmId=&phoneManufacturerName=&smBiosManufacturerName=3kL1se945&phoneDeviceModel=&smBiosDm=AKQK79S92iI82:T798,"disk-drill-win4.5.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{3711362D-9DD7-4681-A2DC-082EFD802C41}\*.* (UID: 00000000-00006460) "disk-drill-win4.5.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006460) "disk-drill-win4.5.exe" called "FindNextFileW" with parameter .cr (UID: 00000000-00006460) "disk-drill-win4.5.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{3711362D-9DD7-4681-A2DC-082EFD802C41}\.cr\*.* (UID: 00000000-00006460) "disk-drill-win4.5.exe" called "FindNextFileW" with parameter disk-drill-win4.5.exe (UID: 00000000-00006460) "disk-drill-win4.5.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\.ba\1033\thm.wxl (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\.ba\1033\thm.xml (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\.ba\thm.xml (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Package Cache\{a13977d2-381b-4fba-a79e-6b13b9beb784}\DiskDrillSetup.4.5.616.0.exe (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindFirstFileW" with parameter C:\DokanSetup.1.4.1.1000.exe (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\DokanSetup.exe (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\*.* (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindNextFileW" with parameter .ba (UID: 00000000-00003636) "disk-drill-win4.5.exe" called "FindNextFileW" with parameter .be (UID: 00000000-00003636)83:T407,File "dokan1.cat" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Third Party Component CA 2014, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 330000003bcd6bd83bc671b8fe00000000003b; Valid From: 03/11/2020 17:31:15; Until: 03/05/2021 17:31:15; Fingerprints: MD5=ED:D8:E9:0E:09:6B:CF:60:99:F2:1F:F2:A0:A8:69:C9; SHA1=98:CD:71:41:B4:DD:14:B2:B0:4B:19:A0:44:FF:0F:E8:F2:F4:B6:5B) File "dokan1.cat" is a certificate (Owner: CN=Microsoft Windows Third Party Component CA 2014, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Certificate Authority 2010, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 330000000d690d5d7893d076df00000000000d; Valid From: 10/15/2014 20:31:27; Until: 10/15/2029 20:41:27; Fingerprints: MD5=DC:FA:56:50:8D:FF:12:0D:93:6D:D6:27:F3:8C:A2:F9; SHA1=19:06:DC:F6:26:29:B5:63:25:2C:82:6F:DD:87:4E:FC:EB:68:56:C6)84:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/wAAAAAABmmWYAAAAAAA//8AAAAA9maRmWZvAAAAAP//AAAAf4RmGZFmSP8AAAD//wAA/4/0ZhmRZk/4/wAA//8AD/j/9HRhlkdP/4/wAP//APiP//Z3GZF3b//4/wD//wCI///2d2EWd2///4gA//8Pj///9meIiHdv///48P//AzOP//Z4d3iHb//4MzD//wMzM//2h3d3eG//MzMw//8zMzM393eIiHdvczMzM///M7szMzd4j/iHczMzOzP//zu7szM4iId4iDMzM7uz//87u7MzOIiP+IiDMzu7s///O7uzM4iHiIh4iDO7u7P//zu7szOIiIiIj4gzO7uz//87uzMzd4eHeIh3Mzu7s///O7szM2Zmf/dmZjM7u7P//zu7M/aIiGd2iIhvM7uz//87uzN2iIhvhoiIZzO7s///M7szdoiIb4aIiGczuzP//wO7M3bu7m+G7u5nM7sw//8DOzP27u5v9u7ubzOzMP//ADszP2ZmiIhmZvMzswD//wAzMzF4j/+IiPMTMzMA//8AAzMxOI//+IiDEzMwAP//AAAzMRcfiIiIgTMzAAD//wAACzERcxEREREzsAAA//8AAAADEQERERERMAAAAP//AAAAABERERERMQAAAAD//wAAAAARMzMzMRAAAAAA/////////xEREf////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==85:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/wAAAAAABmmWYAAAAAAA//8AAAAA9maRmWZvAAAAAP//AAAAf4RmGZFmSP8AAAD//wAA/4/0ZhmRZk/4/wAA//8AD/j/9HRhlkdP/4/wAP//APiP//Z3GZF3b//4/wD//wCI///2d2EWd2///4gA//8Pj///9meIiHdv///48P//AzOP//Z4d3iHb//4MzD//wMzM//2h3d3eG//MzMw//8zMzM393eIiHdvczMzM///M7szMzd4j/iHczMzOzP//zu7szM4iId4iDMzM7uz//87u7MzOIiP+IiDMzu7s///O7uzM4iHiIh4iDO7u7P//zu7szOIiIiIj4gzO7uz//87uzMzd4eHeIh3Mzu7s///O7szM2Zmf/dmZjM7u7P//zu7M/aIiGd2iIhvM7uz//87uzN2iIhvhoiIZzO7s///M7szdoiIb4aIiGczuzP//wO7M3bu7m+G7u5nM7sw//8DOzP27u5v9u7ubzOzMP//ADszP2ZmiIhmZvMzswD//wAzMzF4j/+IiPMTMzMA//8AAzMxOI//+IiDEzMwAP//AAAzMRcfiIiIgTMzAAD//wAACzERcxEREREzsAAA//8AAAADEQERERERMAAAAP//AAAAABERERERMQAAAAD//wAAAAARMzMzMRAAAAAA/////////xEREf////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790890861970,"unified_at":"2026-10-01T21:41:01.970Z","metadata":{"hashes":{"sha256":"3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e","sha1":"d260d5d4aa9a6da30edb94d935cf9566e89c06bb","md5":"1730dff22c3688600b80474038776342","sha512":"3e0b41184f20d7228c48cad79d49362438a9f2b931b2e1325d36c71d3444258c11d39eb411f9a735de51b0c89c526c528221aed6c6f6b74083fc391c0fb769e2","ssdeep":"786432:ZGp1L8SK2xg3n0aHnIa8nVJeilE0y8jtaUjD19QLDZ:U4Sj6Zjijdjtrc","ssdeep_chunks":["786432:ZGp1L8S","786432:Gp1L8SK","786432:p1L8SK2","786432:1L8SK2x","786432:L8SK2xg","786432:8SK2xg3","786432:SK2xg3n","786432:K2xg3n0","786432:2xg3n0a","786432:xg3n0aH","786432:g3n0aHn","786432:3n0aHnI","786432:n0aHnIa","786432:0aHnIa8","786432:aHnIa8n","786432:HnIa8nV","786432:nIa8nVJ","786432:Ia8nVJe","786432:a8nVJei","786432:8nVJeil","786432:nVJeilE","786432:VJeilE0","786432:JeilE0y","786432:eilE0y8","786432:ilE0y8j","786432:lE0y8jt","786432:E0y8jta","786432:0y8jtaU","786432:y8jtaUj","786432:8jtaUjD","786432:jtaUjD1","786432:taUjD19","786432:aUjD19Q","786432:UjD19QL","786432:jD19QLD","786432:D19QLDZ","1572864:ZGp1L8S","1572864:Gp1L8SK","1572864:p1L8SK2","1572864:1L8SK2x","1572864:L8SK2xg","1572864:8SK2xg3","1572864:SK2xg3n","1572864:K2xg3n0","1572864:2xg3n0a","1572864:xg3n0aH","1572864:g3n0aHn","1572864:3n0aHnI","1572864:n0aHnIa","1572864:0aHnIa8","1572864:aHnIa8n","1572864:HnIa8nV","1572864:nIa8nVJ","1572864:Ia8nVJe","1572864:a8nVJei","1572864:8nVJeil","1572864:nVJeilE","1572864:VJeilE0","1572864:JeilE0y","1572864:eilE0y8","1572864:ilE0y8j","1572864:lE0y8jt","1572864:E0y8jta","1572864:0y8jtaU","1572864:y8jtaUj","1572864:8jtaUjD","1572864:jtaUjD1","1572864:taUjD19","1572864:aUjD19Q","1572864:UjD19QL","1572864:jD19QLD","1572864:D19QLDZ","786432:U4Sj6Zj","786432:4Sj6Zji","786432:Sj6Zjij","786432:j6Zjijd","786432:6Zjijdj","786432:Zjijdjt","786432:jijdjtr","786432:ijdjtrc"],"imphash":"42d651751c1d75ed4fa8fe71751854ff"},"file_info":{"file_name":"disk-drill-win(2).exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":30342056,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1659362078000,"last_seen":1768160514000,"last_multi_scan":1768160514000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":113},"sandbox_signatures":{"informative_count":304,"suspicious_count":36,"malicious_count":16,"total":356},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the name of the user associated with the current thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Observed system security related strings"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Observed AdjustTokenPrivileges API string"},{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"},{"type":"informative","value":"Observed strings related to Windows privileges"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Process deletes itself"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Observed RtlGetVersion/RtlGetNtProductType API string"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Observed GetNativeSystemInfo API string"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1471","attack_id_wiki":"https://attack.mitre.org/techniques/T1471","identifiers":[{"type":"informative","value":"Observed Crypto APIs"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve event logs (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"malicious","value":"Contains ability to capture the screen"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Write document files in a temp directory"},{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Contains ability to download files from the internet"},{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Calls an API typically used to retrive the URL data"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"malicious","value":"Drops system driver"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"malicious","value":"Contains ability to change service configuration"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Contains key cryptographic functions of the CryptoAPI"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"suspicious","value":"The input sample dropped/contains a certificate file"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Network Provider DLL","attack_id":"T1556.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1556/008","identifiers":[{"type":"informative","value":"Contains ability to register a logon event"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"malicious","value":"Detected Rundll32 process execution"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Defense Evasion","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"informative","value":"Detected msiexec.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Observed Crypto APIs","description":"\"CryptProtectMemory\" observed api string which can \"performs encryption on the memory\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\" , \"CryptUnprotectMemory\" observed api string which can \"performs decrytion on the memory\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\"","origin":"File/Memory","mitre_attack_id":"T1471","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"disk-drill-win_2_.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"disk-drill-win_2_.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"disk-drill-win_2_.exe\" queries volume information of \"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\logo.png\" at 00000000-00003548-0000010C-33086323","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$25","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/70 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\agent\\_work\\66\\s\\build\\ship\\x86\\burn.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"wixstdba.dll\" contains export function called \"BootstrapperApplicationCreate\" at ordinal 1\n \"wixstdba.dll\" contains export function called \"BootstrapperApplicationDestroy\" at ordinal 2\n \"wixstdba.dll\" contains export function called \"MbaPrereqBootstrapperApplicationCreate\" at ordinal 3\n \"wixstdba.dll\" contains export function called \"MbaPrereqBootstrapperApplicationDestroy\" at ordinal 4","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISK-DRILL-WIN_2_.EXE.62EDCE26.bin\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"DiskDrillSetup.4.5.616.0.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"wixstdba.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"disk-drill-win_2_.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$26","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"General","name":"Observed AdjustTokenPrivileges API string","description":"\"AdjustTokenPrivileges\" observed api string which can \"provides the ability to enable or disable privileges in the specified access token\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\"","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"informative","category":"General","name":"Observed GetNativeSystemInfo API string","description":"\"GetNativeSystemInfo\" observed api string which can \"provides the ability to retrieves information about the current system\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"informative","category":"General","name":"Observed RtlGetVersion/RtlGetNtProductType API string","description":"\"RtlGetVersion\" observed api string which can \"provides the ability to retrieve version info about the currently running os\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\" , \"Failed to locate RtlGetVersion.\" observed api string which can \"provides the ability to retrieve version info about the currently running os\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"disk-drill-win_2_.exe\" touched \"XML DOM Document\" (Path: \"HKCU\\CLSID\\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\")\n \"disk-drill-win_2_.exe\" touched \"Computer\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"disk-drill-win_2_.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\INPROCSERVER32\")\n \"disk-drill-win_2_.exe\" touched \"Microsoft Multiple AutoComplete List Container\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00BB2765-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")\n \"disk-drill-win_2_.exe\" touched \"Microsoft Shell Folder AutoComplete List\" (Path: \"HKCU\\CLSID\\{03C036F1-A186-11D0-824A-00AA005B4383}\\TREATAS\")\n \"disk-drill-win_2_.exe\" touched \"Microsoft AutoComplete\" (Path: \"HKCU\\CLSID\\{00BB2763-6A77-11D0-A535-00C04FD7D062}\\INPROCSERVER32\")\n \"disk-drill-win_2_.exe\" touched \"Microsoft TipAutoCompleteClient Control\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\" has an executable section named \".text\"\n \"DISK-DRILL-WIN_2_.EXE.62EDCE26.bin\" has an executable section named \".text\"\n \"wixstdba.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"disk-drill-win_2_.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"disk-drill-win_2_.exe\" with commandline \"-burn.clean.room=\"C:\\disk-drill-win_2_.exe\" -burn.filehandle.att ...\" (UID: 00000000-00003548)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"disk-drill-win_2_.exe\" with commandline \"-burn.clean.room=\"C:\\disk-drill-win_2_.exe\" -burn.filehandle.att ...\" (UID: 00000000-00003548)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB\" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB\" (SHA1: 92:E2:17:D7:36:CE:94:B1:72:32:B3:C2:36:5A:48:81:7C:4C:A0:DB; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"disk-drill-win_2_.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://sectigo.com/CPS0\" (Indicator: \"https://\") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"\" Observed import api GetCommandLineA which can \"Retrieves the command-line string for the current process\" (Source: static-7b2a5b37cbe8205d5c91d57089d797d9.xml\" \n \" Observed import api GetCommandLineA which can \"Retrieves the command-line string for the current process\" (Source: static-292bcae1f5b2418483328593816f0714.xml\" \n \" Observed import api GetCommandLineA which can \"Retrieves the command-line string for the current process\" (Source: static-8307275f9f9c592deffe4ed98063b605.xml\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$2a","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Observed strings related to Windows privileges","description":"\"seshutdownprivilege\" observed seshutdownprivilege privilege string which can \"Shut down the system\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\"","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"informative","category":"System Security","name":"Observed system security related strings","description":"\"AdjustTokenPrivileges\" observed api string which can \"Enables or disables privileges in the specified access token\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\" , \"CreateWellKnownSid\" observed api string which can \"Creates a SID for predefined aliases\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\" \n \"InitializeAcl\" observed api string which can \"Initializes a new ACL structure\" (Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\"","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"disk-drill-win_2_.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"DISK-DRILL-WIN_2_.EXE.62EDCE26.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"wixstdba.dll\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"C:\\disk-drill-win_2_.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"disk-drill-win_2_.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\363115D86DE743542A9B76B8A1C73482\\INSTALLPROPERTIES\")\n \"disk-drill-win_2_.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\700B6F71FEBD1B446A296767C0EF186B\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"disk-drill-win_2_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"very@cleverfiles.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin\" has resource with unusual entropy \"RT_ICON:7.98051380151\"\n \"DISK-DRILL-WIN_2_.EXE.62EDCE26.bin\" has resource with unusual entropy \"RT_ICON:7.98051380151\"","origin":"Static Parser","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DiskDrillSetup.4.5.616.0.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.be\\DiskDrillSetup.4.5.616.0.exe]- [targetUID: 00000000-00003548]\n \"wixstdba.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\wixstdba.dll]- [targetUID: 00000000-00003548]\n \"disk-drill-win_2_.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe]- [targetUID: 00000000-00003548]","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"disk-drill-win_2_.exe\" wrote 4096 bytes starting with PE header signature to file \"%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"disk-drill-win_2_.exe\" wrote 15922 bytes starting with PE header signature to file \"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\wixstdba.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\disk-drill-win_2_.exe\" marked \"%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"disk-drill-win_2_.exe\" opened \"%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISK-DRILL-WIN_2_.EXE.62EDCE26.bin\" claimed CRC 892166 while the actual is CRC 30342891\n \"wixstdba.dll\" claimed CRC 231729 while the actual is CRC 892166","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n RegDeleteKeyW\n SetSecurityDescriptorDacl\n OpenProcessToken\n GetUserNameW\n RegOpenKeyExW\n RegEnumKeyExW\n RegDeleteValueW\n ChangeServiceConfigW\n GetFileAttributesW\n GetTempPathW\n ConnectNamedPipe\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n LoadLibraryExA\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n GetSystemDirectoryW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n VirtualProtect\n OpenProcess\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetSystemInfo\n GetTempFileNameW\n GetComputerNameW\n GetFileSizeEx\n FindNextFileW\n FindFirstFileW\n FindFirstFileExW\n CreateFileW\n CreateFileA\n GetNativeSystemInfo\n CreateFileMappingW\n GetCommandLineW\n GetCommandLineA\n CopyFileExW\n MapViewOfFile\n GetModuleHandleA\n GetModuleHandleW\n WriteFile\n CreateProcessW\n Sleep\n VirtualAlloc\n ShellExecuteExW\n GetCursorPos\n FindNextFileA\n FindResourceExA\n GetModuleFileNameA\n FindFirstFileExA\n LockResource\n GetUpdateRect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"disk-drill-win_2_.exe\" wrote bytes \"c04e9a7720549b77e0659b77b5389c770000000000d0a37600000000c5eaa3760000000088eaa37600000000e968b67582289c77ee299c7700000000d269b675000000007dbba3760000000009beb67500000000ba18a37600000000\" to virtual address \"0x76331000\" (part of module \"NSI.DLL\")\n \"disk-drill-win_2_.exe\" wrote bytes \"d5d9a37630c6a376e0c2a37642c6a37610c6a376acdca376a0dfa37636daa37687f1a3760000000091770376c09003767f6f03761ffa0376def40376f2820376857d037600000000\" to virtual address \"0x6E961000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"disk-drill-win_2_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"disk-drill-win_2_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"disk-drill-win_2_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.be\\DiskDrillSetup.4.5.616.0.exe\"\n File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\wixstdba.dll\"\n File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"disk-drill-win_2_.exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe\" (Handle: 172)\n \"disk-drill-win_2_.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe\" (Handle: 172)\n \"disk-drill-win_2_.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe\" (Handle: 172)\n \"disk-drill-win_2_.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\Temp\\{FF9E3C91-F02A-400F-810D-974E0B6B59EC}\\.cr\\disk-drill-win_2_.exe\" (Handle: 172)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\".wuauserv\" (Indicator: \"wuauserv\")","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Setup.exe\" (UID: 00000000-00002976) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", __PROCESS_HISTORY=\"C:\\Setup.exe\"\"\n Process \"Setup.exe\" (UID: 00000000-00002976) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"[0BA0:0FE8][2022-08-01T14:03:25]i000: Setting version variable 'BundleAlreadyInstalledX64' to value '0.0.0.0'\"\n Potential IP \"0.0.0.0\" found in string \"[0BA0:0FE8][2022-08-01T14:03:25]i000: Setting version variable 'BundleAlreadyInstalledX86' to value '0.0.0.0'\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"disk-drill-win4.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00005028)\n \"disk-drill-win4.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00002756)\n \"DiskDrillSetup.4.5.616.0.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00002124)\n \"DiskDrillSetup.4.5.616.0.exe\" called \"FindResourceW\" with parameter \"9990\" - (UID: 00000000-00002124)\n \"DokanSetup.1.4.1.1000.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00000336)\n \"DokanSetup.1.4.1.1000.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00002348)\n \"DokanSetup.exe\" called \"FindResourceW\" with parameter \"1\" - (UID: 00000000-00004380)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"$2c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify system service (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"OpenService failed.\" (Indicator: \"OpenService\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002756-00000CBC-3870459833\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.001EF000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.001FC000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.001FC000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.003F5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005028.00000001.311607.00370000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005028.00000003.316362.00370000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$32","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"disk-drill-win4.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"DokanSetup.1.4.1.1000.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"disk-drill-win4.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"disk-drill-win4.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005028-53864-27-010234A2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005028-53864-5-0101E574","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$33","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"CryptProtectMemory\" (Indicator: \"CryptProtectMemory\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$36","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$37","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$39","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"file/memory contains long string with (Indicator: \"sysdriver\"; File: \"MSIB33B.tmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"disk-drill-win4.exe\")\n file/memory contains long string with (Indicator: \"sendmessage\"; File: \"wixstdba.dll\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"InSendMessageEx\" (Indicator: \"sendmessage\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"disk-drill-win4.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002756)\n \"DokanSetup.1.4.1.1000.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002348)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"disk-drill-win4.exe\" called \"IsWow64Process\" with parameter \"2756\" - (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$3a","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"disk-drill-win4.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"disk-drill-win4.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002756)\n \"disk-drill-win4.exe\" called \"OpenMutexW\" with parameter \"DefaultTabtip-MainUI\" - (UID: 00000000-00002756)\n \"DiskDrillSetup.4.5.616.0.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002124)\n \"DokanSetup.1.4.1.1000.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002348)\n \"DokanSetup.1.4.1.1000.exe\" called \"OpenMutexW\" with parameter \"DefaultTabtip-MainUI\" - (UID: 00000000-00002348)\n \"DokanSetup.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004380)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"disk-drill-win4.exe\" called \"LookupAccountSidW\" with param Name gqDibyn (UID: 00000000-00002756)\n \"DiskDrillSetup.4.5.616.0.exe\" called \"LookupAccountSidW\" with param Name gqDibyn (UID: 00000000-00002124)\n \"DokanSetup.1.4.1.1000.exe\" called \"LookupAccountSidW\" with param Name gqDibyn (UID: 00000000-00002348)\n \"DokanSetup.exe\" called \"LookupAccountSidW\" with param Name gqDibyn (UID: 00000000-00004380)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"DokanSetup.1.4.1.1000.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002348)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"disk-drill-win4.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002756)\n \"DiskDrillSetup.4.5.616.0.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002124)\n \"DokanSetup.1.4.1.1000.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002348)\n \"DokanSetup.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004380)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: disk-drill-win4.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: DokanSetup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: DiskDrillSetup.4.5.616.0.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001936.00000001.314312.00150000.00000004.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver generate\" (Indicator: \"ver \") in Source: 00000000-00002124.00000003.318491.00430000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"disk-drill-win4.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"disk-drill-win4.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"DiskDrillSetup.4.5.616.0.exe\" queries volume information of \"C:\\\" at 00000000-00002124-0000010C-3173640\n \"DiskDrillSetup.4.5.616.0.exe\" queries volume information of \"C:\\\" at 00000000-00002124-0000010C-3178163\n \"DiskDrillSetup.4.5.616.0.exe\" queries volume information of \"C:\\\" at 00000000-00002124-0000010C-67677225\n \"DiskDrillSetup.4.5.616.0.exe\" queries volume information of \"C:\\\" at 00000000-00002124-0000010C-67683199","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"disk-drill-win4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"DiskDrillSetup.4.5.616.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"DokanSetup.1.4.1.1000.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"DokanSetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA STREAM ESTABLISHED invalid ack\" (SID: 2210029, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM Packet with invalid ack\" (SID: 2210045, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM ESTABLISHED packet out of window\" (SID: 2210020, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"DiskDrillSetup.4.5.616.0.exe\" called \"CopyFileW\" to copy %WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.be\\DiskDrillSetup.4.5.616.0.exe to new location %ALLUSERSPROFILE%\\Package Cache\\{a13977d2-381b-4fba-a79e-6b13b9beb784}\\DiskDrillSetup.4.5.616.0.exe (UID: 00000000-00002124)\n \"DokanSetup.exe\" called \"CopyFileW\" to copy %WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.be\\DokanSetup.exe to new location %ALLUSERSPROFILE%\\Package Cache\\{9af3b5e1-ed1b-48df-a34f-22fa6bcc4b04}\\DokanSetup.exe (UID: 00000000-00004380)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$47","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$48","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"disk-drill-win4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\BurnPipe.{D25F2013-007E-4FD2-9CA0-AA2EFF12545E}\" - (UID: 00000000-00002756)\n \"disk-drill-win4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\BurnPipe.{D25F2013-007E-4FD2-9CA0-AA2EFF12545E}.Cache\" - (UID: 00000000-00002756)\n \"DiskDrillSetup.4.5.616.0.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\BurnPipe.{7B27780B-0B1C-479B-9776-AA4616B328C9}\" - (UID: 00000000-00002124)\n \"DokanSetup.1.4.1.1000.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\BurnPipe.{39776088-EBC0-4BED-9240-DAD20CA1C2C8}\" - (UID: 00000000-00002348)\n \"DokanSetup.1.4.1.1000.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\BurnPipe.{39776088-EBC0-4BED-9240-DAD20CA1C2C8}.Cache\" - (UID: 00000000-00002348)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$49","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"140.82.114.3:443\"\n \"185.199.111.133:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` = ?\" (Source: 00000000-00001936.00000002.316238.001FC000.00000004.mdmp, Indicator: \"select `action`,null,`condition` from `installexecutesequence` where `sequence` = ?\")\n \"SELECT `Message` FROM `Error` WHERE `Error` = 1709\" (Source: 00000000-00001936.00000002.316238.001FC000.00000004.mdmp, 00000000-00001936.00000002.316238.010D5000.00000004.mdmp, Indicator: \"select `message` from `error` where `error` = 1709\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"181117708620171,2772,3133,,CreateDirectoryW,kernel32.dll,\"262:29:40.145\",RX=0,PX=0\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002124.00000003.318491.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00005028-53864-54-0102815F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"FindResourceExA\" (Indicator: \"FindResource\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$50","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute\"\n \"Global\\_MSIExecute\"\n \"Global\\MSILOG_c77dba361db9b7cgol.ism.68x.puteS.DD_300_95001222305202_0.616.5.4_llirD_ksiD_pmeT_lacoL_ataDppA_nybiDqg_sresU_:C\"\n \"Global\\WindowsUpdateTracingMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\WindowsUpdateTracingMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_c77dba361db9b7cgol.ism.68x.puteS.DD_300_95001222305202_0.616.5.4_llirD_ksiD_pmeT_lacoL_ataDppA_nybiDqg_sresU_:C\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$52","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"disk-drill-win4.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DokanSetup.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DiskDrillSetup.4.5.616.0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"wixstdba.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"MSIE458.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"MSIBDD6.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"MSIE179.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\%ls\n Found string - \\\\.\\pipe\\%ls.Cache\n Found string - \\\\.\\pipe\\BurnPipe.{D25F2013-007E-4FD2-9CA0-AA2EFF12545E}\n Found string - \\\\.\\pipe\\BurnPipe.{D25F2013-007E-4FD2-9CA0-AA2EFF12545E}.Cache\n Found string - \\\\.\\pipe\\BurnPipe.{7B27780B-0B1C-479B-9776-AA4616B328C9}\n Found string - \\\\.\\pipe\\BurnPipe.{39776088-EBC0-4BED-9240-DAD20CA1C2C8}\n Found string - \\\\.\\pipe\\BurnPipe.{39776088-EBC0-4BED-9240-DAD20CA1C2C8}.Cache","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Microsoft-CryptoAPI/6.1\" (Indicator: \"user-agent: \"; Source: \"00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000001.314312.010D5000.00000004.mdmp, 00000000-00001936.00000002.316238.01142000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$53","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$54","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"DokanSetup.1.4.1.1000.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 69510000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"disk-drill-win4.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74C50000\n \"disk-drill-win4.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74810000\n \"DiskDrillSetup.4.5.616.0.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74C50000\n \"DokanSetup.1.4.1.1000.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74C50000\n \"DokanSetup.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74C50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"disk-drill-win4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75EE0000\n \"DiskDrillSetup.4.5.616.0.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75EE0000\n \"DokanSetup.1.4.1.1000.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75EE0000\n \"DokanSetup.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75EE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"15001600c03e516a@ADVAPI32.dll\"\n \"0e000f00703f516a@ADVAPI32.dll\"\n \"0e000f00cc3f516a@ADVAPI32.dll\"\n \"11001200b447516a@ADVAPI32.dll\"\n \"110012004848516a@ADVAPI32.dll\"\n \"120013008c48516a@ADVAPI32.dll\"\n \"12001300e448516a@ADVAPI32.dll\"\n \"14001500dc6f516a@ADVAPI32.dll\"\n \"14001500f46f516a@ADVAPI32.dll\"\n \"140015000c70516a@ADVAPI32.dll\"\n \"170018002470516a@ADVAPI32.dll\"\n \"0d000e003c70516a@ADVAPI32.dll\"\n \"110012004c70516a@ADVAPI32.dll\"\n \"110012006070516a@ADVAPI32.dll\"\n \"0d000e003449516a@SHELL32.dll\"\n \"0d000e00b049516a@SHELL32.dll\"\n \"0f001000a071516a@ADVAPI32.dll\"\n \"14001500e071516a@ADVAPI32.dll\"\n \"14001500f871516a@ADVAPI32.dll\"\n \"0c000d004072516a@ADVAPI32.dll\"\n \"0c000d005072516a@ADVAPI32.dll\"\n \"0e000f006072516a@ADVAPI32.dll\"\n \"0e000f007072516a@ADVAPI32.dll\"\n \"0b000c008072516a@ADVAPI32.dll\"\n \"18001900b874516a@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$55","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"disk-drill-win4.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DokanSetup.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DiskDrillSetup.4.5.616.0.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"wixstdba.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"MSIE458.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"MSIBDD6.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"MSIE179.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"disk-drill-win4.exe\" has an writable section named \".data\"\n \"DokanSetup.exe\" has an writable section named \".data\"\n \"DiskDrillSetup.4.5.616.0.exe\" has an writable section named \".data\"\n \"wixstdba.dll\" has an writable section named \".data\"\n \"MSIE458.tmp\" has an writable section named \".data\"\n \"MSIBDD6.tmp\" has an writable section named \".data\"\n \"MSIE179.tmp\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$56","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$57","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"github.com\"\n \"objects.githubusercontent.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"disk-drill-win4.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"DokanSetup.1.4.1.1000.exe\" opens a file C:\\Windows\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\license.rtf (UID: 00000000-00002348)\n \"DokanSetup.1.4.1.1000.exe\" opens a file %WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\license.rtf (UID: 00000000-00002348)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"disk-drill-win4.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DokanSetup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DiskDrillSetup.4.5.616.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"wixstdba.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSIE458.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSIBDD6.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSIE179.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Write document files in a temp directory","description":"\"DokanSetup.1.4.1.1000.exe\" writes a file C:\\Windows\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\license.rtf (UID: 00000000-00002348)\n \"DokanSetup.1.4.1.1000.exe\" writes a file %WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\license.rtf (UID: 00000000-00002348)","origin":"API Call","mitre_attack_id":"T1119","relevance":2,"id":"api-249","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"disk-drill-win4.exe\" writes to a file \"C:\\Windows\\Temp\\{B5073109-9407-4E64-A6E5-671794E4A156}\\.cr\\disk-drill-win4.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"disk-drill-win4.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"DiskDrillSetup.4.5.616.0.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"$5a","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"MSIE458.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows InstallShield self-extracting archive\"\n \"MSIBDD6.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSIB33B.tmp\" has type \"data\"\n \"MSIE179.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"disk-drill-win4.exe\" reads file \"c:\\disk-drill-win4.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"disk-drill-win4.exe\" writes file \"c:\\windows\\temp\\{b5073109-9407-4e64-a6e5-671794e4a156}\\.cr\\disk-drill-win4.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"disk-drill-win4.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Disk_Drill_4.5.616.0_20250322210059.log\"\n \"DiskDrillSetup.4.5.616.0.exe\" writes a file \"C:\\Windows\\WindowsUpdate.log\"\n \"DiskDrillSetup.4.5.616.0.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Disk_Drill_4.5.616.0_20250322210059_003_DD.Setup.x86.msi.log\"\n \"DokanSetup.1.4.1.1000.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Dokan_Library_1.4.1.1000_Bundle_20250323092124.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"disk-drill-win4.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"HEAD\" object: /dokan-dev/dokany/releases/download/v1.4.1.1000/DokanSetup.exe\" - (UID: 00000000-00002756), \"disk-drill-win4.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /dokan-dev/dokany/releases/download/v1.4.1.1000/DokanSetup.exe\" - (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"disk-drill-win4.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002756)\n \"DiskDrillSetup.4.5.616.0.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002124)\n \"DokanSetup.1.4.1.1000.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002348)\n \"DokanSetup.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004380)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"disk-drill-win4.exe\" called \"InternetReadFile\" with parameter 65536 (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"disk-drill-win4.exe\" called \"InternetOpenA with parameter Burn\" (UID: 00000000-00002756)\n \"disk-drill-win4.exe\" called \"InternetOpenW with parameter Burn\" (UID: 00000000-00002756)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpCloseHandle\" (Indicator: \"WinHttpCloseHandle\"; Source: \"00000000-00001936.00000001.314312.00150000.00000004.mdmp\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00001936.00000002.316238.00150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"objects.githubusercontent.com\" (Indicator: \"githubusercontent.com\"; File: \"PCAP\")\n file/memory contains long string with (Indicator: \"githubusercontent.com\"; Source: \"00000000-00002756-00000CB7-3929033442\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00001936.00000001.314312.00150000.00000004.mdmp\n 00000000-00001936.00000002.316238.001FC000.00000004.mdmp]\n Observed email domain:\"fq%umx.0y0\" [Source: 00000000-00001936.00000001.314312.010D5000.00000004.mdmp\n 00000000-00001936.00000001.314312.02460000.00000004.mdmp\n 00000000-00001936.00000002.316238.0111C000.00000004.mdmp\n 00000000-00001936.00000002.316238.02460000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$61","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"tigoPublicCodeSigningCAEVR36.crl HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001936.00000001.314312.00150000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001936.00000001.314312.010D5000.00000004.mdmp, 00000000-00001936.00000002.316238.010D5000.00000004.mdmp\")\n Found string \"tigoPublicCodeSigningRootR46.crl HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001936.00000001.314312.010D5000.00000004.mdmp\")\n Found string \"T /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001936.00000001.314312.010D5000.00000004.mdmp, 00000000-00001936.00000002.316238.01142000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"objects.githubusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff\n Observed JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d\n Observed JA3 fingerprint: db95a4cb23548a635a1dfebcee9991cb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"140.82.114.3\" on port \"443\"\n HTTPS traffic to \"185.199.111.133\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$62","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$63","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$64","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"disk-drill-win4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"DiskDrillSetup.4.5.616.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"DokanSetup.1.4.1.1000.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"DokanSetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"disk-drill-win4.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}\n \"DiskDrillSetup.4.5.616.0.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}\n \"DokanSetup.1.4.1.1000.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}\n \"DokanSetup.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"thm.wxl\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00001936.00000001.314312.00150000.00000004.mdmp, 00000000-00001936.00000002.316238.00150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"GetDCOrgEx\" (Indicator: \"GetDC\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: disk-drill-win4.exe)\n Found GetCursorPos() in an import section (Source: DokanSetup.exe)\n Found GetCursorPos() in an import section (Source: DiskDrillSetup.4.5.616.0.exe)\n Found GetCursorPos() in an import section (Source: wixstdba.dll)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (API string)","description":"Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"Failed to locate RtlGetVersion.\" (Indicator: \"RtlGetVersion\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"Failed to locate RtlGetVersion.\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"1314534552923,2772,3024,,RtlGetVersion,NTDLL.dll,\"253:15:25.190\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002124.00000000.310751.003C0000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"Failed to locate RtlGetVersion.\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"51803887808784,3032,104,,GetKeyState,user32.dll,\"253:09:07.065\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002348.00000001.317721.002B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp, 00000000-00002348.00000002.318391.012FA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"24108726951840,3032,111,,GetSystemMetrics,user32.dll,\"253:08:47.409\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002348.00000001.317721.002B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"FDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"disk-drill-win4.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"DokanSetup.1.4.1.1000.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"disk-drill-win4.exe\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"disk-drill-win4.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"disk-drill-win4.exe\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"DiskDrillSetup.4.5.616.0.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\ProgramData\\Package Cache\\.unverified\\DokanSetup.exe\" (UID: 00000000-00002124), \"DiskDrillSetup.4.5.616.0.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002124), \"DiskDrillSetup.4.5.616.0.exe\" called an API \"AdjustTokenPrivileges\"on file: \\Device\\NamedPipe\\BurnPipe.{7B27780B-0B1C-479B-9776-AA4616B328C9}\" (UID: 00000000-00002124)\n \"DokanSetup.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004380)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: disk-drill-win4.exe]\n Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: DokanSetup.exe]\n Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: DiskDrillSetup.4.5.616.0.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: disk-drill-win4.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: DokanSetup.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: DiskDrillSetup.4.5.616.0.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")\n Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"55246831241456,3964,113,,SystemParametersInfoW,user32.dll,\"253:10:22.189\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001936.00000002.316238.0111C000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002348.00000000.315798.70B01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001936.00000001.314312.008D1000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$71","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$72","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{dcbfaac4-d863-11e7-b9ff-806e6f6e6963}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00002124.00000000.310751.003C0000.00000004.mdmp, 00000000-00002124.00000001.312672.003C0000.00000004.mdmp, 00000000-00002124.00000002.314598.003C0000.00000004.mdmp, 00000000-00002124.00000003.318491.00430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; File: \"disk-drill-win4.exe\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00000336.00000000.315653.0109A000.00000002.mdmp\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00002124.00000000.310751.00D2A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$74","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"logo.png\" has type \"PNG image data 420 x 474 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"logo.png\" has type \"PNG image data 64 x 64 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"disk-drill-win4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"DokanSetup.1.4.1.1000.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"disk-drill-win4.exe\" has section name .text with entropy \"6.572059575788497\"\n \"disk-drill-win4.exe\" has section name .reloc with entropy \"6.788270717274864\"\n \"DokanSetup.exe\" has section name .text with entropy \"6.572059575788497\"\n \"DokanSetup.exe\" has section name .reloc with entropy \"6.788270717274864\"\n \"DiskDrillSetup.4.5.616.0.exe\" has section name .text with entropy \"6.572059575788497\"\n \"DiskDrillSetup.4.5.616.0.exe\" has section name .reloc with entropy \"6.788270717274864\"\n \"wixstdba.dll\" has section name .text with entropy \"6.613142314600768\"\n \"wixstdba.dll\" has section name .reloc with entropy \"6.486795364878957\"\n \"MSIE458.tmp\" has section name .text with entropy \"6.62528330152611\"\n \"MSIE458.tmp\" has section name .reloc with entropy \"6.417701236221673\"\n \"MSIBDD6.tmp\" has section name .data with entropy \"6.1416411164778495\"\n \"MSIE179.tmp\" has section name .text with entropy \"6.025334210339244\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"disk-drill-win4.exe queries ProcessDebugPort (UID: 2756)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"DokanSetup.1.4.1.1000.exe\" reads file \"C:\\Windows\\win.ini\"\n \"DokanSetup.1.4.1.1000.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"DiskDrillSetup.4.5.616.0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"DiskDrillSetup.4.5.616.0.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"{A13977D2-381B-4FBA-A79E-6B13B9BEB784}\"; Value: \"\"%ALLUSERSPROFILE%\\Package Cache\\{a13977d2-381b-4fba-a79e-6b13b9beb784}\\DiskDrillSetup.4.5.616.0.exe\" /burn.runonce\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 140.82.114.3 on port 443 is sent without HTTP header\n TCP traffic to 185.199.111.133 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"disk-drill-win4.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$75","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"DokanSetup.1.4.1.1000.exe\" allocated memory in \"%WINDIR%\\Temp\\{10423C26-E71D-44B2-B629-F7E289357C3C}\\.cr\\DokanSetup.1.4.1.1000.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"disk-drill-win4.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\")\n \"disk-drill-win4.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$76","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00007584-27997-1166-010967E5\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00001904-51479-814-01388F71\n Found reference to API RtlGetVersion@NTDLL.DLL at 00000000-00002384-911-814-01388F71","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00007584-27997-1212-010A993E\n FindFirstFileW@KERNEL32.DLL at 00000000-00007584-27997-575-010D4315\n FindFirstFileExW@KERNEL32.DLL at 00000000-00007584-27997-111-010C7DBC\n FindFirstFileW@KERNEL32.DLL at 00000000-00007584-27997-765-01093BC3\n FindFirstFileW@KERNEL32.DLL at 00000000-00001904-51479-395-013B5D81\n FindFirstFileW@KERNEL32.DLL at 00000000-00001904-51479-436-013B6D15\n FindFirstFileW@KERNEL32.DLL at 00000000-00001904-51479-897-01398E6E\n FindFirstFileW@KERNEL32.DLL at 00000000-00002384-911-897-01398E6E\n FindFirstFileW@KERNEL32.DLL at 00000000-00002384-911-436-013B6D15\n FindFirstFileW@KERNEL32.DLL at 00000000-00002384-911-395-013B5D81\n FindFirstFileW@KERNEL32.dll at 11343-1480-0041993E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007584-27997-1091-010BE513\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007584-27997-570-010D5BBF\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007584-27997-953-010D8733\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00001904-51479-632-013B8581\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001904-51479-873-013A7516\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001904-51479-787-013AA39F\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00002384-911-632-013B8581\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002384-911-787-013AA39F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002384-911-873-013A7516","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$77","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00007584-27997-953-010D8733\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00001904-51479-632-013B8581\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00002384-911-632-013B8581","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00007584-27997-1153-01096184\n GetVersionExW@KERNEL32.DLL at 00000000-00007584-27997-167-0109508D\n RtlGetVersion@NTDLL.DLL at 00000000-00007584-27997-1166-010967E5\n GetVersionExW@KERNEL32.DLL at 00000000-00007584-27997-700-010D39CD\n GetVersionExW@KERNEL32.DLL at 00000000-00001904-51479-47-01381B46\n GetVersionExW@KERNEL32.DLL at 00000000-00001904-51479-817-01389028\n GetVersionExW@KERNEL32.DLL at 00000000-00001904-51479-372-013B69E2\n RtlGetVersion@NTDLL.DLL at 00000000-00001904-51479-814-01388F71\n GetVersionExW@KERNEL32.DLL at 00000000-00002384-911-817-01389028\n GetVersionExW@KERNEL32.DLL at 00000000-00002384-911-47-01381B46\n RtlGetVersion@NTDLL.DLL at 00000000-00002384-911-814-01388F71\n GetVersionExW@KERNEL32.DLL at 00000000-00002384-911-372-013B69E2\n GetVersionExW@KERNEL32.dll at 11343-1421-00406184","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$78","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00007584-27997-162-01093B51\n GetProcessHeap@KERNEL32.DLL at 00000000-00007584-27997-157-01093A72\n GetProcessHeap@KERNEL32.DLL at 00000000-00007584-27997-156-010938D4\n GetProcessHeap@KERNEL32.DLL at 00000000-00007584-27997-160-01093999\n GetProcessHeap@KERNEL32.DLL at 00000000-00007584-27997-2005-010C95F0\n GetProcessHeap@KERNEL32.DLL at 00000000-00007584-27997-159-01093A97\n GetProcessHeap@KERNEL32.DLL at 00000000-00001904-51479-55-013B0858\n GetProcessHeap@KERNEL32.DLL at 00000000-00001904-51479-71-013B299C\n GetProcessHeap@KERNEL32.DLL at 00000000-00001904-51479-68-013B2955\n GetProcessHeap@KERNEL32.DLL at 00000000-00001904-51479-69-013B2977\n GetProcessHeap@KERNEL32.DLL at 00000000-00002384-911-68-013B2955\n GetProcessHeap@KERNEL32.DLL at 00000000-00002384-911-55-013B0858\n GetProcessHeap@KERNEL32.DLL at 00000000-00002384-911-71-013B299C\n GetProcessHeap@KERNEL32.DLL at 00000000-00002384-911-69-013B2977\n GetProcessHeap@KERNEL32.dll at 11343-2355-004395F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"vc_redist.14.28.29325.x86.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00007584-27997-756-010A4CE8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$79","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00007584-27997-1151-010960BA\n GetUserNameW@ADVAPI32.DLL at 00000000-00001904-51479-839-01389AB0\n GetUserNameW@ADVAPI32.DLL at 00000000-00002384-911-839-01389AB0\n GetUserNameW@ADVAPI32.dll at 11343-1419-004060BA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrive the URL data","description":"\"disk-drill-win4.exe\" called \"InternetReadFile\" with parameter 2147549184 (UID: 00000000-00002308)\n \"disk-drill-win4.exe\" called \"InternetReadFile\" (UID: 00000000-00002308)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the name of the user associated with the current thread (API string)","description":"Observed api string:\"GetUserNameW\" [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"Observed function DecodePointer in mfcm140u.dll\n Observed function EncodePointer in mfcm140u.dll\n Observed function in mfcm140u.dll","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetEnvironmentVariable API","description":"Observed import api \"GetEnvironmentVariable\" which can \"read the host's architecture\" [Source: vcomp140.dll]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-81","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: 3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"wixstdba.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\wixstdba.dll]- [targetUID: 00000000-00007584]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"Failed to parse approved exes.\" (Indicator: \"exes\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains key cryptographic functions of the CryptoAPI","description":"CryptAcquireContextW@ADVAPI32.DLL at 00000000-00007584-27997-888-010CF961\n CryptAcquireContextW@ADVAPI32.DLL at 00000000-00001904-51479-560-013B7C27\n CryptAcquireContextW@ADVAPI32.DLL at 00000000-00002384-911-560-013B7C27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1486","relevance":4,"id":"stream-10","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"VC_redist.x86.exe\" issued more than 3000 memory allocations","origin":"API Call","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"vc_redist.14.28.29325.x86.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"vc_redist.14.28.29325.x86.exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \"vc_redist.14.28.29325.x86.exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \"vc_redist.14.28.29325.x86.exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"vc_redist.14.28.29325.x86.exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"vc_redist.14.28.29325.x86.exe\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \"vc_redist.14.28.29325.x86.exe\" read file \"%USERPROFILE%\\OneDrive\\desktop.ini\"\n \"VC_redist.x86.exe\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00000000-00001904-51479-858-013A6FC7\n InternetReadFile@WININET.DLL at 00000000-00002384-911-858-013A6FC7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"disk-drill-win4.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.be\\DiskDrillSetup.4.5.616.0.exe\" -q -burn.elevated BurnPipe.{0CAF287C-AEF\" - (UID: 00000000-00002308)\n \"DiskDrillSetup.4.5.616.0.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\Package Cache\\85354326EF8FBE908D9331446B8C8463577C5633\\vc_redist.14.28.29325.x86.exe\" /norestart /q /chainingpacka\" - (UID: 00000000-00003804)\n \"vc_redist.14.28.29325.x86.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.be\\VC_redist.x86.exe\" -q -burn.elevated BurnPipe.{2D69C7F4-37BA-4DB4-89B8\" - (UID: 00000000-00007584)\n \"VC_redist.x86.exe\" called \"CreateProcessW\" with parameter \"\"%ALLUSERSPROFILE%\\Package Cache\\{e2803110-78b3-4664-a479-3611a381656a}\\VC_redist.x86.exe\" -uninstall -quiet -burn.related.upgrade -b\" - (UID: 00000000-00007704)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"General","name":"Contains ability to change service configuration","description":"ChangeServiceConfigW@ADVAPI32.DLL at 00000000-00007584-27997-1229-010B6945\n ChangeServiceConfigW@ADVAPI32.DLL at 00000000-00001904-51479-924-0139EDA9\n ChangeServiceConfigW@ADVAPI32.DLL at 00000000-00002384-911-924-0139EDA9\n ChangeServiceConfigW@ADVAPI32.dll at 11343-1497-00426945","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":5,"id":"stream-73","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"2/71 Antivirus vendors marked spawned process \"msiexec.exe\" (PID: 2628) as malicious (classified as \"Virus.Expiro\" with 2% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Contains ability to capture the screen","description":"CreateCompatibleDC@GDI32.DLL at 00000000-00007584-27997-1248-010AE31B\n CreateCompatibleDC@GDI32.dll at 11343-1516-0041E31B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1113","relevance":3,"id":"stream-72","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00007584-27997-1248-010AE31B\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00007584-27997-1250-010AE705\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00001904-51479-970-01396385\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00001904-51479-929-0139130D\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002384-911-970-01396385\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002384-911-929-0139130D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"WPFHexaEditor.dll\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"WPFHexaEditor.dll\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; File: \"disk-drill-win4.5.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"disk-drill-win4.5.exe\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001316.00000000.69193.00B1A000.00000002.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00001316.00000000.69193.00B1A000.00000002.mdmp\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003636.00000001.69618.00F5A000.00000002.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00003636.00000001.69618.00F5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Detected msiexec.exe process execution","description":"Process \"MsiExec.exe\" with commandline \"-Embedding BE0D574DBAABF84FBE122AAEB5BC72DA\" (UID: 00000000-00008152)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 4472C36CEA06B2D43AAFB786E45CB81D E Global\\\\MSI0000\" (UID: 00000000-00004132)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 7F947DA09B0075822D99F7CB43A4CC26 E Global\\\\MSI0000\" (UID: 00000000-00004184)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 0F94213D74B7947F47356B0B6EF62AD1\" (UID: 00000000-00003472)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 77E96F2BC8C03B674AB93E9AE841B7A8 E Global\\\\MSI0000\" (UID: 00000000-00007628)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 25862C94462D9635E491805BC0B7C02F\" (UID: 00000000-00004652)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 0C9E6BBD1553EC5A19BD980FC9FA3A23 E Global\\\\MSI0000\" (UID: 00000000-00004516)\n","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$7a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 4508-2187-0042F0B2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 4508-2443-00423C70\n GetSystemTimeAsFileTime@KERNEL32.dll at 4508-2705-00424AF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 4508-3458-00459B77\n GetLocaleInfoW@KERNEL32.dll at 4508-3459-0045994D\n GetLocaleInfoW@KERNEL32.dll at 4508-3457-004596FA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpace\" (Indicator: \"GetDiskFreeSpace\"; File: \"memfs.exe.1726315649\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; File: \"memfs.exe.1726315649\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 4508-4338-004577AA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"disk-drill-win4.5.exe\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00001316.00000000.69193.00B1A000.00000002.mdmp\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"00000000-00003636.00000001.69618.00F5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$7b","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\0\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"disk-drill-win4.5.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"DokanSetup.1.4.1.1000.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.digicert.com\"\n \"ocsp.comodoca.com\"\n \"ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: WinSparkle.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: CrashSender1403.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libSoftMeter.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: libdokanfuse1.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: cygdokanfuse1.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: mirror.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains ability to register a logon event","description":"\"dokannp1.dll\" contains export function called \"NPGetCaps\" at ordinal 13\n \"dokannp1.dll\" contains export function called \"NPLogonNotify\" at ordinal 500","origin":"Static Parser","mitre_attack_id":"T1556.008","relevance":1,"id":"static-176","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"disk-drill-win4.5.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"disk-drill-win4.5.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001316.00000000.69193.00B1A000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001316.00000000.69193.00B1A000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003636.00000001.69618.00F5A000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00003636.00000001.69618.00F5A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"MapVirtualKey\" in \"WPFHexaEditor.dll\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$7c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 6FD70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at A51B0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 7AA20000\n \"rundll32.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 7AA20000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"WPFHexaEditor.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x164a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x164924\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"WinSparkle.dll\" has high imagebase \"0x180000000\"\n \"CrashSender1403.exe\" has high imagebase \"0x140000000\"\n \"libSoftMeter.dll\" has high imagebase \"0x180000000\"\n \"memfs.exe\" has high imagebase \"0x140000000\"\n \"dokanfuse1.dll\" has high imagebase \"0x180000000\"\n \"libdokanfuse1.dll\" has high imagebase \"0x614c0000\"\n \"dokan1.dll\" has high imagebase \"0x180000000\"\n \"libdokanfuse1.dll\" has high imagebase \"0x616c0000\"\n \"dokannp1.dll\" has high imagebase \"0x180000000\"\n \"cygdokanfuse1.dll\" has high imagebase \"0x6edc0000\"\n \"cygdokanfuse1.dll\" has high imagebase \"0x5bd8f0000\"\n \"mirror.exe\" has high imagebase \"0x100400000\"\n \"mirror.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"dokan.inf\" has type \"Windows setup INFormation\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"disk-drill-win4.5.exe\" queries basic process information of the \"C:\\disk-drill-win4.5.exe\" (UID: 6460)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$7d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"msiexec.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\Disk Drill.lnk\"\n \"msiexec.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\CleverFiles Disk Drill (x64)\\Disk Drill.lnk\"\n \"msiexec.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\CleverFiles Disk Drill (x64)\\Uninstall Disk Drill.lnk\"\n \"msiexec.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\CleverFiles Disk Drill (x64)\\Help&Support.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$7e","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"msiexec.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"e449d9d0\"\n \"lpReserved\": \"0\"}\n \"msiexec.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"e449eb10\"\n \"lpReserved\": \"0\"}\n \"msiexec.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"e449ef60\"\n \"lpReserved\": \"0\"}\n \"rundll32.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"a96fc5f0\"\n \"lpReserved\": \"0\"}\n \"rundll32.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"a9709080\"\n \"lpReserved\": \"0\"}\n \"rundll32.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"96aee950\"\n \"lpReserved\": \"0\"}\n \"rundll32.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"b0f68560\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"file/memory contains long string with (Indicator: \"@gmail.\"; File: \"license.mit.txt\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$7f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$80","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$81","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"DDCore.dll\"\n YARA signature for AES encryption matched on file \"ddactivator.dll\"\n YARA signature for AES encryption matched on file \"WinSparkle.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"rundll32.exe\" called \"GetComputerNameA\" (UID: 00000000-00002328)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00002328)\n \"rundll32.exe\" called \"GetComputerNameA\" (UID: 00000000-00006236)\n \"rundll32.exe\" called \"GetComputerNameW\" (UID: 00000000-00006236)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"rundll32.exe\" called \"GetUserNameA\" (UID: 00000000-00002328)\n \"rundll32.exe\" called \"GetUserNameA\" (UID: 00000000-00006236)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$82","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"format specifier requires numeric argument\" (Indicator: \"format \"; File: \"memfs.exe.1726315649\")\n Found string \"format specifier requires signed argument\" (Indicator: \"format \"; File: \"memfs.exe.1726315649\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00003636.00000001.69618.06131000.00000004.mdmp, 00000000-00003636.00000002.71537.06110000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"rundll32.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6536)\n \"rundll32.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 2328)\n \"rundll32.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 4180)\n \"rundll32.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 6236)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 31 calls to GetProcAddress@KERNEL32.dll at 4508-3609-0042BB81","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"dbghelp.dll\"; File: \"CrashRpt1403.dll\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 007b211c39ead601 & 007b211c39ead601 (UID: 00000000-00007192)\n \"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 0005e16c8f9dd801 & 0005e16c8f9dd801 (UID: 00000000-00007192)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 4508-4388-0042C24A\n GetModuleHandleW@KERNEL32.dll at 4508-2250-0042EF54\n GetModuleHandleW@KERNEL32.dll at 4508-2162-0043AFDE\n GetModuleHandleA@KERNEL32.dll at 4508-2157-0042F3D0\n GetModuleHandleW@KERNEL32.dll at 4508-2163-0042ED23\n GetModuleHandleW@KERNEL32.dll at 4508-4335-0042BAD8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 4508-3418-0045166D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Installation/Persistence","name":"The input sample dropped/contains a certificate file","description":"$83","origin":"Binary File","mitre_attack_id":"T1588.004","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"disk-drill-win4.5.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"disk-drill-win4.5.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 4508-4496-0044E939","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 4508-3379-0044DD6F\n GetModuleFileNameW@KERNEL32.dll at 4508-2157-0042F3D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected Rundll32 process execution","description":"Process \"rundll32.exe\" with commandline \"\"%WINDIR%\\\\Installer\\\\MSIC72F.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1099640 84 msiGaCustomAction!msiGaCustomAction.CustomActions.gaCheckInstallConditionCustomAction\" (UID: 00000000-00006536)\n Process \"rundll32.exe\" with commandline \"\"%WINDIR%\\\\Installer\\\\MSIE614.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1107468 106 msiGaCustomAction!msiGaCustomAction.CustomActions.gaSuccessCustomAction\" (UID: 00000000-00002328)\n Process \"rundll32.exe\" with commandline \"\"%WINDIR%\\\\Installer\\\\MSI4EF1.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1134375 116 msiGaCustomAction!msiGaCustomAction.CustomActions.gaCheckInstallConditionCustomAction\" (UID: 00000000-00004180)\n Process \"rundll32.exe\" with commandline \"\"%WINDIR%\\\\Installer\\\\MSI6105.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1138953 138 msiGaCustomAction!msiGaCustomAction.CustomActions.gaSuccessCustomAction\" (UID: 00000000-00006236)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":10,"id":"target-115","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"/F /IM DD.exe\" (UID: 00000000-00006728)\n Process \"taskkill.exe\" with commandline \"/F /IM DD.exe\" (UID: 00000000-00005292)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Windows system process connects to a network","description":"Process \"rundll32.exe\" connects to 142.251.46.238:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"dokan1.sys\" has type \"PE32+ executable (native) x86-64 for MS Windows\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /dokan-dev/dokany/releases/download/v1.4.1.1000/DokanSetup.exe HTTP/1.1Accept: */*\n User-Agent: Burn\n Host: github.com\n Connection: Keep-Alive\n Cache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}]},"activity":{"stats":{"process_count":26,"spawned_processes_count":26,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":111,"imported_dlls_count":211,"dropped_files_count":0,"extracted_files_count":118,"files_written_count":464,"files_deleted_count":0,"registry_keys_created_count":72,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":77,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":5,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["evasive","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files","Simulated analysis","Network Traffic","Sample Crashed"],"sandbox_reports":[{"id":"67df24d91c036ed4100544f2","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["NLD","USA"],"submit_name":"disk-drill-win4.exe","analysis_start_time":"2025-03-22T21:00:15+00:00","indicators_count":{"informative":232,"suspicious":73,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"66067e31e9c1eae6f30eb9ec","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["NLD","USA"],"submit_name":"disk-drill-win4.5.exe","analysis_start_time":"2024-03-29T08:40:24+00:00","indicators_count":{"informative":254,"suspicious":78,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"63771f5fc2e46f2466413684","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["NLD","USA"],"submit_name":"disk-drill-win4.exe","analysis_start_time":"2022-11-18T06:00:05+00:00","indicators_count":{"informative":71,"suspicious":69,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"62edcd863aacf10cc81a1731","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"disk-drill-win(2).exe","analysis_start_time":"2022-08-06T02:10:19+00:00","indicators_count":{"informative":30,"suspicious":17,"malicious":3},"tags":["Multi-Process","Extracted Files","Simulated analysis"],"is_in_unified_schema":true},{"id":"62e7db1376f2c011d706ed72","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"Setup.exe","analysis_start_time":"2022-08-01T14:00:46+00:00","indicators_count":{"informative":31,"suspicious":19,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"140.82.114.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"address":"185.199.111.133","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"address":"140.82.112.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"address":"185.199.108.133","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"address":"192.229.211.108","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"address":"104.18.38.233","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"address":"172.64.149.23","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}],"dns_resolutions":[{"domain":"github.com","address":"140.82.114.3","ttl":60,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1283.AWSDNS-32.ORG","registrar_creation_date":"2007-10-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"domain":"objects.githubusercontent.com","address":"185.199.111.133","ttl":1815,"country":"Netherlands","registrar_name":"MarkMonitor, Inc.","registrar_organization":"GitHub, Inc.","registrar_name_servers":"NS-1411.AWSDNS-48.ORG","registrar_creation_date":"2014-02-06T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"domain":"ocsp.comodoca.com","address":"104.18.38.233","ttl":485,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Comodo Group, Inc.","registrar_name_servers":"NS0.COMODODNS.COM","registrar_creation_date":"2002-11-13T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"domain":"ocsp.digicert.com","address":"192.229.211.108","ttl":20819,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"domain":"ocsp.sectigo.com","address":"104.18.38.233","ttl":3599,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}],"http_requests":[{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"host":"ocsp.digicert.com","host_ip":"192.229.211.108:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAeCv86tt3hFyS%2BM4rQZ1tM%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.digicert.com","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"host":"ocsp.comodoca.com","host_ip":"104.18.38.233:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.comodoca.com","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEDkmbV7eakndJkTHVT55Q5I%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}],"processes":[{"pid":6460,"ppid":0,"name":"disk-drill-win4.5.exe","command_line":"","sha256":"3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e","normalized_path":"C:\\disk-drill-win4.5.exe","uid":"00000000-00006460","icon":"$84"},{"pid":3636,"ppid":6460,"name":"disk-drill-win4.5.exe","command_line":"-burn.clean.room=\"C:\\disk-drill-win4.5.exe\" -burn.filehandle.attached=784 -burn.filehandle.self=616","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","normalized_path":"%WINDIR%\\Temp\\{3711362D-9DD7-4681-A2DC-082EFD802C41}\\.cr\\disk-drill-win4.5.exe","parent_uid":"00000000-00006460","uid":"00000000-00003636"},{"pid":4120,"ppid":3636,"name":"DiskDrillSetup.4.5.616.0.exe","command_line":"-q -burn.elevated BurnPipe.{9347538C-13A1-4951-8A37-2F00F1BDDA82} {ECE00D40-DF1E-47C2-9928-7E34F2A82167} 3636","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","normalized_path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.be\\DiskDrillSetup.4.5.616.0.exe","parent_uid":"00000000-00003636","uid":"00000000-00004120"},{"pid":1316,"ppid":4120,"name":"DokanSetup.1.4.1.1000.exe","command_line":"/norestart /quiet /install -burn.filehandle.self=1084 -burn.embedded BurnPipe.{375BC4B0-1533-45B3-AD11-4E942E9420FC} {39676D33-0F9A-43C1-A25F-1A7562C2F8B9} 4120","sha256":"e77587fe6abbf3866d227d05c0dd0bd287f604f7d66d124f1855e1a6094c71a9","normalized_path":"%ALLUSERSPROFILE%\\Package Cache\\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\\DokanSetup.1.4.1.1000.exe","parent_uid":"00000000-00004120","uid":"00000000-00001316"},{"pid":4788,"ppid":1316,"name":"DokanSetup.1.4.1.1000.exe","command_line":"-burn.clean.room=\"%ALLUSERSPROFILE%\\Package Cache\\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\\DokanSetup.1.4.1.1000.exe\" -burn.filehandle.attached=736 -burn.filehandle.self=620 /norestart /quiet /install -burn.filehandle.self=1084 -burn.embedded BurnPipe.{375BC4B0-1533-45B3-AD11-4E942E9420FC} {39676D33-0F9A-43C1-A25F-1A7562C2F8B9} 4120","sha256":"01fed5d4c0ecfdbda0c66f2caf50a41813570aa2a1876c637292a88277092c98","normalized_path":"%WINDIR%\\Temp\\{9487E10F-13DB-439A-B713-48BE2B949A6F}\\.cr\\DokanSetup.1.4.1.1000.exe","parent_uid":"00000000-00001316","uid":"00000000-00004788"},{"pid":7024,"ppid":4788,"name":"DokanSetup.exe","command_line":"-q -burn.elevated BurnPipe.{D3918890-2B9A-4D6A-A449-EDDB8A0153AF} {F5AED14C-15C7-48AE-8B05-B55A7C3288DE} 4788","sha256":"01fed5d4c0ecfdbda0c66f2caf50a41813570aa2a1876c637292a88277092c98","normalized_path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.be\\DokanSetup.exe","parent_uid":"00000000-00004788","uid":"00000000-00007024"},{"pid":3124,"ppid":4120,"name":"DokanSetup.1.4.1.1000.exe","command_line":"/norestart /quiet /install -burn.filehandle.self=1048 -burn.embedded BurnPipe.{FFE99D2B-7F17-4222-86B0-ADC17F808EDE} {B4C6B3A9-C2BB-4121-AEA5-9F333F6F9406} 4120","sha256":"e77587fe6abbf3866d227d05c0dd0bd287f604f7d66d124f1855e1a6094c71a9","normalized_path":"%ALLUSERSPROFILE%\\Package Cache\\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\\DokanSetup.1.4.1.1000.exe","parent_uid":"00000000-00004120","uid":"00000000-00003124"},{"pid":5924,"ppid":3124,"name":"DokanSetup.1.4.1.1000.exe","command_line":"-burn.clean.room=\"%ALLUSERSPROFILE%\\Package Cache\\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F\\DokanSetup.1.4.1.1000.exe\" -burn.filehandle.attached=624 -burn.filehandle.self=632 /norestart /quiet /install -burn.filehandle.self=1048 -burn.embedded BurnPipe.{FFE99D2B-7F17-4222-86B0-ADC17F808EDE} {B4C6B3A9-C2BB-4121-AEA5-9F333F6F9406} 4120","sha256":"01fed5d4c0ecfdbda0c66f2caf50a41813570aa2a1876c637292a88277092c98","normalized_path":"%WINDIR%\\Temp\\{6B70C454-3712-4E86-A240-40C3BCC34B39}\\.cr\\DokanSetup.1.4.1.1000.exe","parent_uid":"00000000-00003124","uid":"00000000-00005924"},{"pid":2944,"ppid":5924,"name":"DokanSetup.exe","command_line":"-q -burn.elevated BurnPipe.{FAE4A223-F64E-49C5-8ADA-0C21637C8865} {47A5A8E6-1E42-4C91-93F9-EA743001A701} 5924","sha256":"01fed5d4c0ecfdbda0c66f2caf50a41813570aa2a1876c637292a88277092c98","normalized_path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.be\\DokanSetup.exe","parent_uid":"00000000-00005924","uid":"00000000-00002944"},{"pid":7192,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00007192","icon":"$85"},{"pid":8152,"ppid":7192,"name":"MsiExec.exe","command_line":"-Embedding BE0D574DBAABF84FBE122AAEB5BC72DA","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00007192","uid":"00000000-00008152"},{"pid":4132,"ppid":7192,"name":"MsiExec.exe","command_line":"-Embedding 4472C36CEA06B2D43AAFB786E45CB81D E Global\\MSI0000","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00007192","uid":"00000000-00004132"},{"pid":4184,"ppid":7192,"name":"MsiExec.exe","command_line":"-Embedding 7F947DA09B0075822D99F7CB43A4CC26 E Global\\MSI0000","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00007192","uid":"00000000-00004184"},{"pid":9012,"ppid":4184,"name":"dokanctl.exe","command_line":"/i n","sha256":"b43221715e0ac15ecd529660cda869663ec16a44b2a2671b3e595fdb0eee2b02","normalized_path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\dokanctl.exe","parent_uid":"00000000-00004184","uid":"00000000-00009012"},{"pid":3472,"ppid":7192,"name":"MsiExec.exe","command_line":"-Embedding 0F94213D74B7947F47356B0B6EF62AD1","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00007192","uid":"00000000-00003472"},{"pid":6536,"ppid":3472,"name":"rundll32.exe","command_line":"\"%WINDIR%\\Installer\\MSIC72F.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1099640 84 msiGaCustomAction!msiGaCustomAction.CustomActions.gaCheckInstallConditionCustomAction","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\system32\\rundll32.exe","parent_uid":"00000000-00003472","uid":"00000000-00006536"},{"pid":2328,"ppid":3472,"name":"rundll32.exe","command_line":"\"%WINDIR%\\Installer\\MSIE614.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1107468 106 msiGaCustomAction!msiGaCustomAction.CustomActions.gaSuccessCustomAction","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\system32\\rundll32.exe","parent_uid":"00000000-00003472","uid":"00000000-00002328"},{"pid":7628,"ppid":7192,"name":"MsiExec.exe","command_line":"-Embedding 77E96F2BC8C03B674AB93E9AE841B7A8 E Global\\MSI0000","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00007192","uid":"00000000-00007628"},{"pid":6728,"ppid":7628,"name":"taskkill.exe","command_line":"/F /IM DD.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00000000-00007628","uid":"00000000-00006728"},{"pid":8976,"ppid":7192,"name":"cfbackd.w32.exe","command_line":"-i","sha256":"22bc7470e441bc5287a6664884226fa1f027863e58141e4d3aeb3f2d96a33254","normalized_path":"%PROGRAMFILES%\\CleverFiles\\Disk Drill\\cfbackd.w32.exe","parent_uid":"00000000-00007192","uid":"00000000-00008976"},{"pid":4652,"ppid":7192,"name":"MsiExec.exe","command_line":"-Embedding 25862C94462D9635E491805BC0B7C02F","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00007192","uid":"00000000-00004652"},{"pid":4180,"ppid":4652,"name":"rundll32.exe","command_line":"\"%WINDIR%\\Installer\\MSI4EF1.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1134375 116 msiGaCustomAction!msiGaCustomAction.CustomActions.gaCheckInstallConditionCustomAction","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\system32\\rundll32.exe","parent_uid":"00000000-00004652","uid":"00000000-00004180"},{"pid":6236,"ppid":4652,"name":"rundll32.exe","command_line":"\"%WINDIR%\\Installer\\MSI6105.tmp\",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1138953 138 msiGaCustomAction!msiGaCustomAction.CustomActions.gaSuccessCustomAction","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\system32\\rundll32.exe","parent_uid":"00000000-00004652","uid":"00000000-00006236"},{"pid":4516,"ppid":7192,"name":"MsiExec.exe","command_line":"-Embedding 0C9E6BBD1553EC5A19BD980FC9FA3A23 E Global\\MSI0000","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00007192","uid":"00000000-00004516"},{"pid":5292,"ppid":4516,"name":"taskkill.exe","command_line":"/F /IM DD.exe","sha256":"75f4aed9bf21d8f9b2b1a2ddbc1f2c7e4e0aef8b3b94bd5eda02d9d84c34f33f","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00000000-00004516","uid":"00000000-00005292"},{"pid":5136,"ppid":7192,"name":"cfbackd.w32.exe","command_line":"-i","sha256":"22bc7470e441bc5287a6664884226fa1f027863e58141e4d3aeb3f2d96a33254","normalized_path":"%PROGRAMFILES%\\CleverFiles\\Disk Drill\\cfbackd.w32.exe","parent_uid":"00000000-00007192","uid":"00000000-00005136"}],"all_imported_dlls":["GdiPlus.dll","dui70.dll","oleaut32.dll","shlwapi.dll","wixstdba.dll","wintrust.dll","clbcatq.dll","msxml3.dll","feclient.dll","ws2_32.dll","duser.dll","dwmapi.dll","ucrtbase.dll","msvcrt.dll","msctf.dll","fltLib.dll","tiptsf.dll","user32.dll","imm32.dll","msi.dll","uxtheme.dll","msimg32.dll","ntdll.dll","gdi32.dll","msxml3r.dll","advapi32.dll","shell32.dll","sechost.dll","version.dll","profapi.dll","cryptbase.dll","cabinet.dll","WindowsCodecs.dll","ExplorerFrame.dll","KernelBase.dll","rpcrt4.dll","ole32.dll","api-ms-win-core-synch-l1-2-0.dll","bcrypt.dll","nsi.dll","propsys.dll","comdlg32.dll","kernel32.dll","lpk.dll","usp10.dll","rpcss.dll","apphelp.dll","comctl32.dll","wininet.dll","sfc.dll","setupapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","urlmon.dll","wow64win.dll","msacm32.dll","wow64cpu.dll","mpr.dll","devobj.dll","wow64.dll","iertutil.dll","sspicli.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","cfgmgr32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","sfc_os.dll","AcGenral.dll","normaliz.dll","winmm.dll","samcli.dll","userenv.dll","dsrole.dll","IPHLPAPI.DLL","srclient.dll","msasn1.dll","dhcpcsvc6.dll","wshqos.dll","srvcli.dll","bcryptprimitives.dll","wu.upgrade.ps.dll","wuapi.dll","netapi32.dll","ntmarta.dll","atl.dll","ncrypt.dll","es.dll","SensApi.dll","Wldap32.dll","winnsi.dll","RpcRtRemote.dll","sxs.dll","dhcpcsvc.dll","netutils.dll","nlaapi.dll","npmproxy.dll","msimsg.dll","rsaenh.dll","crypt32.dll","vsstrace.dll","dnsapi.dll","rasadhlp.dll","WSHTCPIP.DLL","vss_ps.dll","wkscli.dll","msls31.dll","cryptsp.dll","wship6.dll","vssapi.dll","tzres.dll","eventcls.dll","spp.dll","winhttp.dll","netmsg.dll","mswsock.dll","VxSSL32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","webio.dll","schannel.dll","cryptnet.dll","netprofm.dll","credssp.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","FWPUCLNT.DLL","gpapi.dll","secur32.dll","riched20.dll","imagehlp.dll","OneCoreUAPCommonProxyStub.dll","fusion.dll","SHCore.dll","pcacli.dll","mfc140chs.dll","WinTypes.dll","msIso.dll","usoapi.dll","vcruntime140.dll","mskeyprotect.dll","perfproc.dll","windows.storage.dll","ncryptsslp.dll","OnDemandConnRouteHelper.dll","mfc140rus.dll","srpapi.dll","VxSSL64.dll","ntasn1.dll","msvcp110_win.dll","clr.dll","msisip.dll","aepic.dll","edputil.dll","vcruntime140_clr0400.dll","mscoreei.dll","dpapi.dll","AcLayers.dll","TextInputFramework.dll","coml2.dll","ucrtbase_clr0400.dll","mscoree.dll","wldp.dll","CoreUIComponents.dll","powrprof.dll","gdi32full.dll","msvcp_win.dll","Windows.StateRepositoryPS.dll","winnlsres.dll","sxproxy.dll","win32u.dll","kernel.appcore.dll","cldapi.dll","OneCoreCommonProxyStub.dll","CoreMessaging.dll","combase.dll","RstrtMgr.dll","MpOAV.dll","ntshrui.dll","Windows.System.Launcher.dll","dbghelp.dll","dokan1.dll","winsta.dll","spinf.dll","cscapi.dll","AppResolver.dll","amsi.dll","TextShaping.dll","wbemprox.dll","libSoftMeter.dll","framedynos.dll","wow64base.dll","System.Configuration.ni.dll","Windows.StateRepositoryCore.dll","System.Core.ni.dll","BCP47Langs.dll","umpdc.dll","linkinfo.dll","ServicingCommon.dll","wbemsvc.dll","spfileq.dll","580L51fr.dll","fastprox.dll","mscorlib.ni.dll","drvstore.dll","msiGaCustomAction.dll","wow64con.dll","virtdisk.dll","clrjit.dll","devrtl.dll","System.ni.dll","vcruntime140_1_clr0400.dll","wbemcomn.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"wixstdba.dll","sha256":"2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"DiskDrillSetup.4.5.616.0.exe","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"disk-drill-win_2_.exe","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"name":"DISK-DRILL-WIN_2_.EXE.62EDCE26.bin","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"name":"Disk_Drill_4.5.616.0_20220806021257.log","sha256":"e8553425907e34ef29cce387cc0989e863a11687fb32cea2fa94ea94783b286f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"name":"thm.wxl","sha256":"c55e6457298484fdc450b6a37eff687f62d8f82a750a4761c91897887f503567","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"name":"BootstrapperApplicationData.xml","sha256":"277b8156de184a0752eabba071eaf46bd98a866bfd2e09d34113a8bd9d53bb74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"logo.png","sha256":"23e6ebe4a24a22c55bef84892e42f1cad2873bb9706369056972387df4a72147","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"name":"thm.xml","sha256":"a4e49aca22b395dac46ce6ed1b29789feaf166b1642d59c197ba999669f37ef5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"name":"Setup.exe","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"name":"SETUP.EXE.62E7DD25.bin","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"name":"Disk_Drill_4.5.616.0_20220801140322.log","sha256":"5e0928f3874f7aa7e254a35912b27adcf9646ea3d716422f7a9187d6e5d5251a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62e7db1376f2c011d706ed72"}]},{"name":"DokanSetup.exe","sha256":"01fed5d4c0ecfdbda0c66f2caf50a41813570aa2a1876c637292a88277092c98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"DokanSetup.1.4.1.1000.exe","sha256":"01fed5d4c0ecfdbda0c66f2caf50a41813570aa2a1876c637292a88277092c98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"disk-drill-win4.exe","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"DISK-DRILL-WIN4.EXE.67DF2509.bin","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"DOKANSETUP.1.4.1.1000.EXE.67DFCF12.bin","sha256":"01fed5d4c0ecfdbda0c66f2caf50a41813570aa2a1876c637292a88277092c98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"state.rsm","sha256":"2f776d7018873dfc1804b7d8d41fdf89739c45251f83946ed16923a9dfa7d4ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sha256":"75976d208476ffc06f53a3dc530993e7ca6d9cb43997896a2c890d257e94d77a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"572BF21E454637C9F000BE1AF9B1E1A9","sha256":"d98481e3f27f7e19db4e5585fbdcdbc8c8bb759397efd26cb401b0ec970add5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"892BD135CF0BA5A31C6B8A7554540845","sha256":"2997fe5caed53655f62a78bfb691f4fbbd4175fb1ed19b43e9f6a329849222e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25","sha256":"be749d3e4eb10c96a48aff8e6d0bcbf59d7adc00d9bb524482e3e144378616de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90","sha256":"f9e05758e171cb555f10ccf8adf7384c73d3a811d4bcf79b6f12d295c2a543be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"D9CA54E0FA212456E1DB00704A97658E","sha256":"d606d5e71f65796d850223682e424e57a8c23ada26ddb1921623edf119b9c09f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"Disk_Drill_4.5.616.0_20250322210059.log","sha256":"03805e0bfb33f9f242a57cafcd12c799f13fbb8dfd505896ab41b4b8569e82fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"Dokan_Library_1.4.1.1000_Bundle_20250323092124.log","sha256":"d3f2009ff71dec18f397339bc824f47a915e7581023aca55f9c7797e93a0a405","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"Setup_20250323172737_Failed.txt","sha256":"52038d17c17cbcc6de485acb20f51953b819517b17dcaeaeccb937bf0add6ef6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"vc_redist.14.28.29325.x86.exe","sha256":"e5c0020e115c77403570a0ac0a71607bffaf26b7ca2a33b07ac447429820874b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"VC_redist.x86.exe","sha256":"e5c0020e115c77403570a0ac0a71607bffaf26b7ca2a33b07ac447429820874b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"concrt140.dll","sha256":"6fa65e222f6f18df8a2fc6cc5008c32ac45a8b085418abc58bac8022c9eb6034","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140.dll","sha256":"8ab78170792d1da7b840db58b9663229681d4b08b5c7953db1fe9279b8220777","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140chs.dll","sha256":"22857e342c761ec2af6d749f1c249b0b0ab587b32c8fa6d99b7f84184cabca40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140cht.dll","sha256":"903adfc979fa3eca9fd8cba30a33cd0efe5ea8818d2ece5c21141ae4791b0e7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140deu.dll","sha256":"3539c343b0f832f88833b2084974e311d0391d03e2c0936dc78efeb050b0ae35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140enu.dll","sha256":"7646153b9ab5122b692e0283a34f7e17dbb48f052e2c1ee2d5abdedd64207ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140esn.dll","sha256":"9895507ffeef5ed093c82bd31dbf0c2d57f7d72b0ecf49159140750536920aa0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140fra.dll","sha256":"e80ceaefb210de9d7c2b74593dcadf5710e0216775241bd88ed13629ad9d5f49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140ita.dll","sha256":"1f9a287836cb9c4fe044c6cadc27dd455321c884bb830b720342db2ab7e454ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140kor.dll","sha256":"509765fd338ca83cd76e604af28faa6a3e5a09e683a134a80cd2a943fe8eaddd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140rus.dll","sha256":"f71240e57e60e2b4d9f8f7f7d6530728fbae729bb3d6e6cd88d8929c2355040e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140u.dll","sha256":"e71a02b251a13b4311e475a7903af4e586318788e120e47ec8445a7ba513a539","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfcm140u.dll","sha256":"2a5ac129dbb498b02ea87d426bdf49bfb272e7e451ff657f344001ea514d0f47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"msvcp140.dll","sha256":"08a47a1b10c4bcbaac64b49adf4b8f19b37f5b5820416f2d83f2d71b16bb5f93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"msvcp140_1.dll","sha256":"8906d59ed097e7b857dd19a5323cb0eab006af7d1f20ee233c4c86645c7f3a0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"msvcp140_2.dll","sha256":"be8c7ce5a162f3a8c70531affdeead06854b1faa2fcb63e2c9872bb6d78d31f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"msvcp140_atomic_wait.dll","sha256":"9d26b6bb1a095f58142e64cd58aa819ab52022c7b61dff5ed85170fc2b244732","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"msvcp140_codecvt_ids.dll","sha256":"bf673d0615bb6a0e069e8b9236ee83d8b56251a95a5e8c5bda76ec4bb7e6edc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"vcamp140.dll","sha256":"371b86aa25d5a6c7436b4bd49291b4442c10c815859c19c7bfbe6b860bbf9581","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"vccorlib140.dll","sha256":"c3ab349af32d05491cffccca60770cc1334629e8eda23e07657c858185444a76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"vcomp140.dll","sha256":"9ddb4b123c031834aaa98285c28c9dcd598ca561549292e7c0b1cb3739bb90dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"vcruntime140.dll","sha256":"e30380fb3301b114f4dd4d09a83c8f2b1c0d6885412065f0d163b0fb342d86c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"DISK-DRILL-WIN4.EXE.6376B043.bin","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"VC_REDIST.14.28.29325.X86.EXE.6376B085.bin","sha256":"e5c0020e115c77403570a0ac0a71607bffaf26b7ca2a33b07ac447429820874b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"cab54A5CABBE7274D8A22EB58060AAB7623","sha256":"9fed933fbff0d0c4b82a2e74806257a032f67ff0ecd4e2643b541cf5c4f707f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"cabB3E1576D1FEFBB979E13B1A5379E0B16","sha256":"dc154add0cbb47513e313ee21cf56069785234899322589c3bcc4ca63f5e3c5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"vcredist_2019_x64.exe","sha256":"d930577351ae30d0741be9192468010247820952437b41a2d6955e0428fc5a07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"vcredist_2019_x86.exe","sha256":"cafffb0be9d8f3d0c7b0f234db6f3c9b68fa79fdf4db2793284e0f00dc47e9b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"vcRuntimeAdditional_x86","sha256":"70c875f576ed9bc245438adb708f7bc6d3ccec2da701261bdfb69153aa2e6f78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"vcRuntimeMinimum_x86","sha256":"3488b2cba495fbc74bbd67e507a9748238cbf80cdd27282542b749eba1414ce1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565","sha256":"3a7d3c491f849f8b42ef9c2977827bd0518dc81da3fed06b100837d6a73d45a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"50CD3D75D026C82E2E718570BD6F44D0_60E83F2095C16CA099C94596E7B8AA5D","sha256":"65f6349b540360397f7bb2b77793ecdc78f4e73c3587f48e187e9c915a47abd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sha256":"72b579f3fdd05e234685cb2f4c80bdb4dde108ce07b1c93a16a626547ad4254f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04","sha256":"2b8d64e44681c660e1668accf2ab8844208aae18a0e67c63969b3bd8195d024e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Disk_Drill_4.5.616.0_20221117220557.log","sha256":"ca7996925d0c04e3d5d9f85e5bd32ae700d12b3b9de18fbcba5b51fa405e4ab6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"dd_vcredist_x86_20221117220702.log","sha256":"a86bb8fd7907f30801bd8234c80e5fc69d2212ee5bf1ff4a2afd18251a6a8b51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"dd_vcredist_x86_20221117220838.log","sha256":"fb3b7fc790b51be2dd962cecd73e1e61d5fb27ad381bef263700f97fb82de445","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"license.rtf","sha256":"9ab1e570f8d1257094b0a933017669d68fac393615588df909157125291a4da8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"13fdfb.msi","sha256":"3488b2cba495fbc74bbd67e507a9748238cbf80cdd27282542b749eba1414ce1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"13fe08.msi","sha256":"3488b2cba495fbc74bbd67e507a9748238cbf80cdd27282542b749eba1414ce1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"13fe09.msi","sha256":"70c875f576ed9bc245438adb708f7bc6d3ccec2da701261bdfb69153aa2e6f78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"13fe1e.msi","sha256":"70c875f576ed9bc245438adb708f7bc6d3ccec2da701261bdfb69153aa2e6f78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfc140jpn.dll","sha256":"ec18f6c98cbb5a0d98a503af4477e476f39d80c8c47e90d25510c7637a434760","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"mfcm140.dll","sha256":"19f34b226292ecb4657c812f1c80a022fcb4731b9e49c525076ba812e3280870","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"DD.exe","sha256":"6d91873141adc0d4c2154af76909dda29b4e3a03bfdf619c52270c80a37469b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"1084c2.msi","sha256":"0ccab32e263987a6188211dba9d47de1b46abefc0dde3c778655d72041c7e8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"1084c6.msi","sha256":"0ccab32e263987a6188211dba9d47de1b46abefc0dde3c778655d72041c7e8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"libSoftMeter.dll","sha256":"5a1a3946af161687b26e0a93b84a0b8b794486dcc38ee3eb0bfa7cb63ab144df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"disk-drill-win4.5.exe","sha256":"07f8be3678a7a08e9eb264112fee4357f1be79ec71c85e608646c9c1438fb955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Disk Drill.lnk","sha256":"045e3a11cae2bcd7f94ccc4f88f3ee0edfedf56f7854e155b1557922c56a11dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Uninstall Disk Drill.lnk","sha256":"0c2f0e0a26c31aa11e5fb26603e6fbf07c092e23fc6782a26287efb1bc11cc22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013","sha256":"da2f275a0f4810cebefaebf337da9e2559fbc379756b362977baca181e1e28da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"3AA0DCD5A74331FBD6F344550EC48B87_9800850A9A301D146932FD49596FC194","sha256":"c1950fcfaf802d1a3e6e473a810b93c4c9f610268c09a792a2e4721cff206013","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sha256":"7215b30e692d31dd6fd8dbd4a07b67406b55ab1b3ff45b21bdb005c8defc2ef8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"66AE3BFDF94A732B262342AD2154B86E_A286EAA8D39055C5AA2D89765A6F2B00","sha256":"271dbded07d1a34160e5c90cde1f85b77d3e05c8cf0b44ace7fd1b25f84283f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F","sha256":"da4e4bb6b97ca8abe44fb28887c2e897f88e920ac200f78771554f793c1f8900","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"CrashRpt1403.dll","sha256":"3bf492b45628d4b66d0ad8cfd3a2c5fd7cb5d6bccfefec7737ffb45fe71fec31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"CrashSender1403.exe","sha256":"e0f800c27b9d32168b83e4c5e5bb7e3f9b99490fb328a34d796f7c7a088985e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"DD.exe.config","sha256":"ebb04a79bc394101676d3c20d3eceb6921ceb3c5927a3330a99a6635f0072077","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"DDCore.dll","sha256":"4304669aa2399a1d06df4022f506f5975878d8070fa5c5c3a8c6a13186318482","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"DokanNet.dll","sha256":"a48ba9efa6d31ce8858db68a70b1a6226c29bfc489bd3d0a3ced1e6e4db683d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"FreeImage.dll","sha256":"4b384930611ee8b5be921f32050e23e76c0e14fabdf8ac53ce7bf982d3550eaa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Microsoft.WindowsAPICodePack.Shell.dll","sha256":"8c1c833708010bf7c5c1d4ec538c6d274f6f5d4e4123c4535d2a7da463964132","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Microsoft.WindowsAPICodePack.dll","sha256":"e7aad45e2687a6ca72327645f03c21ab11547178bce5959e0536e054a20dba82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"System.ValueTuple.dll","sha256":"e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"WPFHexaEditor.dll","sha256":"20d21bd8d6675ccf9026ba0c499b17b8e7fd8f617e26002137e5ec0d4e48fea1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"WinSparkle.dll","sha256":"cb13a9a6a88054a26e940a945d8e82f1ceba5858f73a57636226a09b7ce5b4c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"DD.resources.dll","sha256":"ec8eb380781854644134acf51377fbe5cc857bc5d1b0747a41d6a53fc4a5c465","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"cfbackd.w32.exe","sha256":"22bc7470e441bc5287a6664884226fa1f027863e58141e4d3aeb3f2d96a33254","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"ddactivator.dll","sha256":"b35f2b8c0ca3fa655d0461343213f84159dca7faaff2973c76fdc92fb30814dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"libewf.dll","sha256":"3c8dbfaa1295f8f2930807eb0a240af05ddf413d14b7a2181ae553d661bd56d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"zlibwapi.dll","sha256":"a2b38a3587fdb103ff2924ca1b859a806a508830c356dd03a519ea2781c3eaf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"cygdokanfuse1.dll","sha256":"f641179fbe036d2d052f5d54a12c587e1f9da7d4c7a9327c5a5c2b07f19c7d31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"dokan1.dll","sha256":"578f91e0b5046d4972e7602ce62f2d5757dc4a944d03c2a1bcc81f794dff5e6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"dokanctl.exe","sha256":"b43221715e0ac15ecd529660cda869663ec16a44b2a2671b3e595fdb0eee2b02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"dokanfuse1.dll","sha256":"1f5856089bf95b302890afb633cc6c4f3ba955fc07701c4171beb6cfdb2115d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"dokan.inf","sha256":"fd42640a6cdda2e0dea00b9333b39823d6a41996b4d9cfea8888bc037063e144","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"dokan1.cat","sha256":"0cea936ba48026b8e2cb29feba8691e7f16a1a7ee4157f7ea17ef23dc64a1b9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"libdokanfuse1.dll","sha256":"dcd3305f24fb3d9990978cf08b035301cdd74bc554c092ec46e3f6db970a5ef1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"mirror.exe","sha256":"8c544b63c878950ef66a15015db2277ea60740a67bb12e2f95cafe5075570af3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"memfs.exe","sha256":"7d7782a004dd26ba1cdcdbd8ca4c1aba4c4c8d137f42cd7fb385b9d34f4d0aef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"1084c7.msi","sha256":"31affe2be38b97448942ab5430c0d9c2e1340c351a0eea92c09e46009b1c6c28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"1084c9.msi","sha256":"31affe2be38b97448942ab5430c0d9c2e1340c351a0eea92c09e46009b1c6c28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Microsoft.Deployment.WindowsInstaller.dll","sha256":"cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"msiGaCustomAction.dll","sha256":"832ad6cd36d9f94dd22199928b27dabd23d07b06f472df3f55ea69c00e3da70f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"dokannp1.dll","sha256":"a712b8ae7ce026fd619ee9831e2f0f913b674d3b601f4a240adb0cba1749ef04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"DD.Setup.x64.msi","sha256":"31affe2be38b97448942ab5430c0d9c2e1340c351a0eea92c09e46009b1c6c28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Dokan_x64.msi","sha256":"0ccab32e263987a6188211dba9d47de1b46abefc0dde3c778655d72041c7e8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Help_Support.lnk","sha256":"982efad8ca50c69fa6d2ae05558faec6317d2bbe28af4fed889a7ad7d57d6808","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}],"files_written":[{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1036\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1041\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1042\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1086\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Disk_Drill_4.5.616.0_20220806021257.log","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"},{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\thm.xml","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\logo.png","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1025\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1031\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1033\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1034\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1040\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1043\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1045\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1046\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1049\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\2073\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1053\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1055\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\1081\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\2052\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"%WINDIR%\\Temp\\{F86B9C20-DD2F-434B-8982-8CF210ABAC0A}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"62edcd863aacf10cc81a1731"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{B5073109-9407-4E64-A6E5-671794E4A156}\\.cr\\disk-drill-win4.exe","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\wixstdba.dll","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\thm.xml","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\logo.png","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1025\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1031\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1033\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1034\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1036\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1040\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1041\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1042\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1043\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1045\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1046\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1049\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\2073\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1053\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1055\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1081\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\1086\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\2052\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%TEMP%\\Disk_Drill_4.5.616.0_20250322210059.log","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\.be\\DiskDrillSetup.4.5.616.0.exe","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D9CA54E0FA212456E1DB00704A97658E","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\D9CA54E0FA212456E1DB00704A97658E","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\892BD135CF0BA5A31C6B8A7554540845","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\892BD135CF0BA5A31C6B8A7554540845","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\DD.Setup.x86.msi","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\572BF21E454637C9F000BE1AF9B1E1A9","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\572BF21E454637C9F000BE1AF9B1E1A9","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\DokanSetup.exe.R","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{9004B390-EB4B-4193-960E-6A06640D6F3E}\\DokanSetup.exe","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\WindowsUpdate.log","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{a13977d2-381b-4fba-a79e-6b13b9beb784}\\DiskDrillSetup.4.5.616.0.exe","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{a13977d2-381b-4fba-a79e-6b13b9beb784}\\state.rsm","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%TEMP%\\Disk_Drill_4.5.616.0_20250322210059_003_DD.Setup.x86.msi.log","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\.unverified","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Setup_20250323172737_Failed.txt","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{10423C26-E71D-44B2-B629-F7E289357C3C}\\.cr\\DokanSetup.1.4.1.1000.exe","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\wixstdba.dll","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\RESOURCES\\1033","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\Resources\\1033","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\Resources\\1033\\RtfTheme.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\thm.xml","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\logo.png","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\license.rtf","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%TEMP%\\Dokan_Library_1.4.1.1000_Bundle_20250323092124.log","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\.be\\DokanSetup.exe","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{48476752-4B44-4866-B67B-6A80E4FF5F57}\\Dokan_x86.msi","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{9af3b5e1-ed1b-48df-a34f-22fa6bcc4b04}\\DokanSetup.exe","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{9af3b5e1-ed1b-48df-a34f-22fa6bcc4b04}\\state.rsm","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Dokan_Library_1.4.1.1000_Bundle_20250323092124_000_Dokan_x86.msi.log","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\wixstdba.dll","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1025\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1031\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1034\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1036\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1040\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1041\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1042\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1043\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1045\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1046\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1049\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\2073\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1053\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1055\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1081\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\1086\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba\\2052\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}\\.ba","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\Disk_Drill_4.5.616.0_20221117220557.log","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{F243C0C9-AE50-4D35-9B8A-329006F69F85}","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\50CD3D75D026C82E2E718570BD6F44D0_60E83F2095C16CA099C94596E7B8AA5D","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\50CD3D75D026C82E2E718570BD6F44D0_60E83F2095C16CA099C94596E7B8AA5D","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\1786EE165231D491F209FD27B6E3029556AF25BC","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\AB550A8C9B4C8010939D6C52D5A2725F7BE2718F","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{17F6B007-DBEF-44B1-A692-76760CFE81B6}v4.5.616.0","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\wixstdba.dll","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\thm.xml","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\logo.png","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1028\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1028","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1028\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1029\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1029","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1029\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1031\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1031","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1031\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1036\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1036","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1036\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1040\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1040","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1040\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1041\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1041","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1041\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1042\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1042","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1042\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1045\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1045","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1045\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1046\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1046","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1046\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1049\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1049","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1049\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1055\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1055","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\1055\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\2052\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\2052","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\2052\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\3082\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\3082","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\3082\\license.rtf","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\dd_vcredist_x86_20221117220702.log","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{6BF8FF90-1993-4E9D-8AFA-529DFCC655CD}","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{EE2E15BB-54C8-4DB0-B1F3-026E3C166991}v14.28.29325\\PACKAGES\\VCRUNTIMEMINIMUM_X86","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{B40FC85D-2B12-46E0-B950-E5B27E348793}v14.28.29325\\PACKAGES\\VCRUNTIMEADDITIONAL_X86","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF493026350544DD91.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFF342728FB3D191BD.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFF4B0F00B963B64CF.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF2322F744DE20BDFD.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFD62F4D6794792222.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFDB9BC349A2383E56.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF337B3539BA271B54.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"C:\\Config.Msi\\MSIB4C9.tmp","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Installer\\SourceHash{EE2E15BB-54C8-4DB0-B1F3-026E3C166991}","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF762BB3F592311B73.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFDA401E85C151132C.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF3BD6FF570ADDDAEE.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"C:\\Config.Msi\\MSICE6D.tmp","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\SysWOW64\\msvcp140_1.dll","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\SysWOW64\\msvcp140_2.dll","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\SysWOW64\\msvcp140_atomic_wait.dll","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\SysWOW64\\msvcp140_codecvt_ids.dll","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF91F154CFA1EA90BA.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF18C415163E1731FF.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF72D8339D08178A6D.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF33C533EBB6DE8A7D.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"C:\\Config.Msi\\MSIDCA7.tmp","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFA9CF00D762756694.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF8F0689B34FEF9FF9.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\dd_vcredist_x86_20221117220702_000_vcRuntimeMinimum_x86.log","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF1DFB873EA066D932.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF68D7F34C9A321C7C.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DFF42BE6B0101F37AB.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF18CD880FE856D210.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF2B184C8A803CBDFF.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF4BA1D719F72FADD1.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF99C03BE6FF113DD4.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF7CDDD0DCAC873AB2.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFA27D13EE252F48A5.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"C:\\Config.Msi\\MSIA8F.tmp","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Installer\\SourceHash{B40FC85D-2B12-46E0-B950-E5B27E348793}","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFCF75CAA099981ACF.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF58A13A7190012432.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF8735A4A16F1A9BE3.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF01ADDB7A6629628C.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF49E354E11754947C.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF5CED26B81215BDD5.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFEB00741F218AEF7B.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFDC0C61ADBFAC1A66.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF9BB6418D542B64FC.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\dd_vcredist_x86_20221117220702_001_vcRuntimeAdditional_x86.log","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DFE460D7F329DFF2FA.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\~DF2C121985D2F703EA.TMP","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1028","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1029","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1031","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1036","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1040","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1041","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1042","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1045","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1046","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1049","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\1055","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\2052","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1\\3082","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\{e2803110-78b3-4664-a479-3611a381656a}\\.ba1","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%TEMP%\\dd_vcredist_x86_20221117220838.log","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{d7a6435f-ac9a-4af6-8fdc-ca130d13fac9}\\state.rsm","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"path":"%WINDIR%\\Temp\\{3711362D-9DD7-4681-A2DC-082EFD802C41}\\.cr\\disk-drill-win4.5.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\wixstdba.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\thm.xml","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\logo.png","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1025\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1031\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1033\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1034\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1036\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1040\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1041\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1042\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1043\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1045\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1046\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1049\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\2073\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1053\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1055\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1081\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\1086\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\2052\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Disk_Drill_4.5.616.0_20240329084238.log","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\.be\\DiskDrillSetup.4.5.616.0.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\DokanSetup.exe.R","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\DokanSetup.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{2E5E6EF3-036B-4C69-BB1E-6F7CEFE33ACE}\\DD.Setup.x64.msi","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Disk_Drill_4.5.616.0_20240329084238_001_DD.Setup.x64.msi.log","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Disk_Drill_4.5.616.0_20240329084238_003_DD.Setup.x64.msi.log","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{9487E10F-13DB-439A-B713-48BE2B949A6F}\\.cr\\DokanSetup.1.4.1.1000.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba\\wixstdba.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba\\Resources\\1033","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba\\Resources\\1033\\RtfTheme.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba\\thm.xml","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba\\logo.png","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba\\license.rtf","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Dokan_Library_1.4.1.1000_Bundle_20240329084302.log","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\.be\\DokanSetup.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{33F9B438-2450-4C18-9D14-E3B36E4D90B1}\\Dokan_x64.msi","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Dokan_Library_1.4.1.1000_Bundle_20240329084302_000_Dokan_x64.msi.log","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{6B70C454-3712-4E86-A240-40C3BCC34B39}\\.cr\\DokanSetup.1.4.1.1000.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba\\wixstdba.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba\\Resources\\1033","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba\\Resources\\1033\\RtfTheme.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba\\thm.xml","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba\\thm.wxl","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba\\logo.png","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba\\license.rtf","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.ba\\BootstrapperApplicationData.xml","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%TEMP%\\Dokan_Library_1.4.1.1000_Bundle_20240329084355.log","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\{23CC77C5-BC87-4AD7-B52F-3898702812FB}\\.be\\DokanSetup.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\1084c2.msi","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\66AE3BFDF94A732B262342AD2154B86E_A286EAA8D39055C5AA2D89765A6F2B00","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\66AE3BFDF94A732B262342AD2154B86E_A286EAA8D39055C5AA2D89765A6F2B00","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.log","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\inprogressinstallinfo.ipi","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\SystemTemp\\~DFF57C168111A8C1EA.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\SourceHash{65A3A964-3DC3-0104-0001-210114105723}","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\SystemTemp\\~DF7CE8DFE32C496066.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI8FDE.tmp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI91D3.tmp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DF07D529DCDE976B84.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DF00A9DDA2C47806FD.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"C:\\Config.Msi\\CMP955C.tmp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"C:\\Config.Msi\\1084c5.rbs","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\dokan_memfs.vcxproj","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\dokan_memfs.vcxproj","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\mirror\\dokan_mirror.vcxproj","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\mirror\\dokan_mirror.vcxproj","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\dokanctl.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\fuse_mirror\\cygdokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\fuse_mirror\\cygdokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\cygdokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\dokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\lib\\dokanfuse1.lib","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\fuse_mirror\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\fuse_mirror\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\libdokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\dokanfuse1.pdb","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\System32\\dokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\SysWOW64\\dokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\lib\\dokanfuse1.lib","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\dokanfuse1.pdb","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\dokan\\dokan.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\lib\\dokan1.lib","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\mirror\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\mirror\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\System32\\dokannp1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\lib\\dokannp1.lib","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\dokannp1.pdb","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\SysWOW64\\dokannp1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\lib\\dokannp1.lib","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\dokannp1.pdb","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\dokan1.pdb","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\System32\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\SysWOW64\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\lib\\dokan1.lib","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\dokan1.pdb","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\driver\\dokan1.cat","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\driver\\dokan.inf","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\driver\\dokan1.sys","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\driver\\dokan1.pdb","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\dokan\\fileinfo.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\filenode.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\filenode.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\filenodes.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\filenodes.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\filenodes.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\filenodes.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\filenode.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\filenode.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\fuse\\fuse_common.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\fuse.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\fuse\\fuse_opt.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\fuse\\fuse_sem_fix.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\fuse\\fuse_win.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\fuse\\fuse.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\fuse_mirror\\fusexmp.c","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\fuse_mirror\\mirror.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\fuse_mirror\\mirror.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\fuse_mirror\\fusexmp.c","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\license.lgpl.txt","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\license.mit.txt","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\main.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\main.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\memfs_helper.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\memfs_helper.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\memfs_operations.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\memfs_operations.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\memfs_operations.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\memfs_operations.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\memfs.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\memfs.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\memfs\\memfs.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\memfs.cpp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\memfs.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\memfs\\memfs.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\mirror\\mirror.c","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\sample\\mirror\\mirror.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\mirror\\mirror.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\sample\\mirror\\mirror.c","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\dokan\\public.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\README.url","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\include\\fuse\\utils.h","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\dokanctl.exe","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\cygdokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\dokan1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\dokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%PROGRAMFILES%\\Dokan\\Dokan Library-1.4.1\\x86\\libdokanfuse1.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI9E18.tmp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\1084c6.msi","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\{65A3A964-3DC3-0104-0001-210114105723}\\DokanIcon","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIA02D.tmp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DF7E83562C6B9991B6.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DF2825FDCD03B06563.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DFA54C191DBA26E98E.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DF5AAFF229A86154A3.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"C:\\Config.Msi\\CMPA450.tmp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIA454.tmp","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\SystemTemp\\~DFEA17963B9E240444.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\SystemTemp\\~DF2EACBFBD7CE20F72.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DF583B36CE1D22CB41.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Temp\\~DFF5E9701E2DFD522C.TMP","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\1084c7.msi","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3AA0DCD5A74331FBD6F344550EC48B87_9800850A9A301D146932FD49596FC194","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3AA0DCD5A74331FBD6F344550EC48B87_9800850A9A301D146932FD49596FC194","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIC72F.tmp-","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIC72F.tmp-\\msiGaCustomAction.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIC72F.tmp-\\Microsoft.Deployment.WindowsInstaller.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIC72F.tmp-\\CustomAction.config","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIC72F.tmp-\\libSoftMeter.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIE614.tmp-","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIE614.tmp-\\msiGaCustomAction.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIE614.tmp-\\Microsoft.Deployment.WindowsInstaller.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIE614.tmp-\\CustomAction.config","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSIE614.tmp-\\libSoftMeter.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI4EF1.tmp-","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI4EF1.tmp-\\msiGaCustomAction.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI4EF1.tmp-\\Microsoft.Deployment.WindowsInstaller.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI4EF1.tmp-\\CustomAction.config","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI4EF1.tmp-\\libSoftMeter.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI6105.tmp-","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI6105.tmp-\\msiGaCustomAction.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI6105.tmp-\\Microsoft.Deployment.WindowsInstaller.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI6105.tmp-\\CustomAction.config","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"path":"%WINDIR%\\Installer\\MSI6105.tmp-\\libSoftMeter.dll","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPUBLISHER\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPUBLISHER\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPUBLISHER\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INSTALLER\\PRODUCTS\\469A3A563CD340100010121041017532\\SOURCELIST\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\INSTALLER\\PRODUCTS\\700B6F71FEBD1B446A296767C0EF186B\\SOURCELIST\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DOKAN1\\NETWORKPROVIDER\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\CLEVERFILES\\DISK DRILL\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\CFBACKD\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\CFBACKD\\","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"},{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"},{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Global\\MSILOG_c77dba361db9b7cgol.ism.68x.puteS.DD_300_95001222305202_0.616.5.4_llirD_ksiD_pmeT_lacoL_ataDppA_nybiDqg_sresU_:C","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"Global\\WindowsUpdateTracingMutex","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WindowsUpdateTracingMutex","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_c77dba361db9b7cgol.ism.68x.puteS.DD_300_95001222305202_0.616.5.4_llirD_ksiD_pmeT_lacoL_ataDppA_nybiDqg_sresU_:C","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_d5a4fe6c1db9be4gol.ism.68x_nakoD_000_42129032305202_eldnuB_0001.1.4.1_yrarbiL_nakoD_pmeT_lacoL_ataDppA_nybiDqg_sresU_:C","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"Global\\MSILOG_d5a4fe6c1db9be4gol.ism.68x_nakoD_000_42129032305202_eldnuB_0001.1.4.1_yrarbiL_nakoD_pmeT_lacoL_ataDppA_nybiDqg_sresU_:C","sources":[{"report_type":"sandbox","report_id":"67df24d91c036ed4100544f2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3080:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:3080:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2308:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2308:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Global\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:2308:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:2308:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3804:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\NetFxEvent.{0BACC8B6-59B4-493C-9DCA-91F3C3867FCA}_mutex","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\NetFxEvent.{BAF5CB86-DA41-4450-9C39-0947A2B24D3B}_mutex","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"NetFxEvent.{BAF5CB86-DA41-4450-9C39-0947A2B24D3B}_mutex","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:3804:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"NetFxEvent.{0BACC8B6-59B4-493C-9DCA-91F3C3867FCA}_mutex","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:2652:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7584:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7584:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:7584:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:7584:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:7704:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Global\\MSILOG_febd646b1d8fb13gol.68x_muminiMemitnuRcv_000_20702271112202_68x_tsidercv_dd_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Global\\MSILOG_238df8b51d8fb14gol.68x_lanoitiddAemitnuRcv_100_20702271112202_68x_tsidercv_dd_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_febd646b1d8fb13gol.68x_muminiMemitnuRcv_000_20702271112202_68x_tsidercv_dd_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_238df8b51d8fb14gol.68x_lanoitiddAemitnuRcv_100_20702271112202_68x_tsidercv_dd_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1904:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:1904:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:2384:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:2628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Global\\MSILOG_febd646b1d8fb13gol.68x_muminiMemitnuRcv_000_20702271112202_68x_tsidercv_dd_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Global\\MSILOG_238df8b51d8fb14gol.68x_lanoitiddAemitnuRcv_100_20702271112202_68x_tsidercv_dd_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:2628:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\.NET CLR Data_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\.NET CLR Networking_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\.NET Data Provider for Oracle_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\.NET Memory Cache 4.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\.NETFramework_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\BITS_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\ESENT_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Lsa_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\MSDTC_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\MSSCNTRS_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Outlook_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\PerfDisk_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\PerfNet_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\PerfOS_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\PerfProc_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\rdyboost_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\RemoteAccess_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Spooler_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\TapiSrv_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Tcpip_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\TermService_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\UGatherer_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\UGTHRSVC_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\usbhub_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\WmiApRpl_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\WSearchIdxPi_Perf_Library_Lock_PID_a44","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0001","sources":[{"report_type":"sandbox","report_id":"63771f5fc2e46f2466413684"}]},{"name":"Local\\SM0:3636:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:3636:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"SM0:3636:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:4120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"SM0:4120:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:4120:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:4788:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:4788:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"SM0:4788:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:7024:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"SM0:7024:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:6536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:2328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"SM0:5924:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:5924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:5924:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"SM0:2944:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:2944:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2328:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:4180:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]},{"name":"Local\\SM0:6236:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66067e31e9c1eae6f30eb9ec"}]}]}},"report_ids":{"sandbox_job_ids":["63771f5fc2e46f2466413684","66067e31e9c1eae6f30eb9ec","62e7db1376f2c011d706ed72","67df24d91c036ed4100544f2","62edcd863aacf10cc81a1731"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 3eef9e4cf03a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3eef9e4cf03a…. Threat score 100/100. 0/27 AV engines flagged this file. 16 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 3eef9e4cf03a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3eef9e4cf03a…. Threat score 100/100. 0/27 AV engines flagged this file. 16 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3eef9e4cf03a4a99b5cd36b711c8c6fdbedfdd9e3842f97b5801b68fa9751b1e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 3eef9e4cf03a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3eef9e4cf03a…. Threat score 100/100. 0/27 AV engines flagged this file. 16 malicious and 36 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L86","11",{}]]