24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 60:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T543,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application Sample 4923d672142d… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 4923d672142d…. Malware family: Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application. Threat score 85/100. 2/25 AV engines flagged this file. 3 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","keywords":["Malicious","Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application","malware analysis","sandbox report","threat intelligence","4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99"],"about":{"@type":"SoftwareApplication","name":"Agent.exe","applicationCategory":["peexe","executable"],"identifier":"4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application","antivirusDetections":{"malicious":2,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T477,Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin")26:T6aae,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenW"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "UuidToStringW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushInstructionCache"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCanonicalizeUrlW"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetSearchPathMode"; Source: "sample.bin"), Found reference to API (Indicator: "InflateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "MapDialogRect"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpSendRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcStringFreeW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemRealloc"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "InternetGetLastResponseInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "HttpQueryInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "InternetAutodial"; Source: "sample.bin"), Found reference to API (Indicator: "IsBadReadPtr"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WriteProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessTimes"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadContext"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "InternetGetConnectedState"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "DrawIcon"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "InternetReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocale"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "InternetQueryOptionW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "LZCopy"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowDC"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileSectionNamesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetMalloc"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtectEx"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlen"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenUrlW"; Source: "sample.bin"), Found reference to API (Indicator: "VerLanguageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "IntersectRect"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclW"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "InternetErrorDlg"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileString"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "SetMapMode"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HttpOpenRequestW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "EnumChildWindows"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceExW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStretchBltMode"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "SetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreate"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadContext"; Source: "sample.bin"), Found reference to API (Indicator: "InternetConnectW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "CopyRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "PathFileExistsW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePatternBrush"; Source: "sample.bin"), Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSolidBrush"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "LZClose"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCrackUrlW"; Source: "sample.bin"), Found reference to API (Indicator: "DrawFocusRect"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "LZOpenFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "sample.bin")27:T558,"Software\Microsoft\InetStp" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: sample.bin, "Software\Microsoft\Internet Explorer" in Source: sample.bin, "SOFTWARE\InstallShield\24.0\Professional" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: sample.bin, "Software\InstallShieldPendingOperation" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: sample.bin28:T4bc,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "sample.bin"), Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "sample.bin"), Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "sample.bin"), Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "sample.bin"), Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "sample.bin"), Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "sample.bin"), Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "sample.bin")29:T454,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "sample.bin"), Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "Process32First" (Indicator: "Process32First"; Source: "sample.bin")2a:T43e,Found string "Software\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx" (Indicator: "software\microsoft\windows\currentversion\runonceex"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin")2b:T66e,"Agent.exe" queried SystemProcessInformation at 00000000-00002316-00000C15-2123630711 [PID: 2316] "Agent.exe" queried SystemProcessInformation at 00000000-00002316-00000C15-2123639643 [PID: 2316] "Agent.exe" queried SystemProcessInformation at 00000000-00002316-00000C15-2123803498 [PID: 2316] "Agent.exe" queried SystemProcessInformation at 00000000-00002316-00000C15-2123811211 [PID: 2316] "Agent.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-2124390983 [PID: 4960] "Agent.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-2124400556 [PID: 4960] "Agent.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-2124552797 [PID: 4960] "Agent.exe" queried SystemProcessInformation at 00000000-00004960-00000C15-2124561330 [PID: 4960] "cmd.exe" queried SystemProcessInformation at 00000000-00005228-00000C15-2135105666 [PID: 5228] "cmd.exe" queried SystemProcessInformation at 00000000-00005228-00000C15-2135113738 [PID: 5228] "cmd.exe" queried SystemProcessInformation at 00000000-00005228-00000C15-2135268979 [PID: 5228] "cmd.exe" queried SystemProcessInformation at 00000000-00005228-00000C15-2135277833 [PID: 5228] "agentInstallerComponent.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-2135895882 [PID: 6632] "agentInstallerComponent.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-2135904641 [PID: 6632] "agentInstallerComponent.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-2136084400 [PID: 6632] "agentInstallerComponent.exe" queried SystemProcessInformation at 00000000-00006632-00000C15-2136092721 [PID: 6632]2c:Te5c,"Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.exe" to "%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\Agent.exe" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setA95B.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setup.inx" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\InsA99B.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\Install.bat" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FonA9AC.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FontData.ini" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFA9AD.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFxData.ini" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\corA9BD.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\corecomp.ini" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotnetinstaller.exe" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9DE.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotnetinstaller.exe.config" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\StrAA00.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\StringTable_0x0409.ips" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrAA01.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrt.dll" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\defAA40.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\default.pal" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA51.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isuser_0x0409.dll" "Agent.exe" renamed original file"C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA81.tmp" to "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isres_0x0409.dll" "Agent.exe" renamed original file"C:\Windows\Temp\ageC0F8.tmp" to "%WINDIR%\Temp\agentInstallerComponent.exe" "Agent.exe" renamed original file"C:\Windows\Temp\UEMC195.tmp" to "%WINDIR%\Temp\UEMSAgent.msi" "Agent.exe" renamed original file"C:\Windows\Temp\UEMCEA6.tmp" to "%WINDIR%\Temp\UEMSAgent.mst"2d:T651,Found reference to API MessageBoxW@USER32.DLL at 00000000-00004960-16475-31-0101B245 Found reference to API FindFirstFileW@KERNEL32.DLL at 00000000-00004960-16475-620-010044D0 Found reference to API GetFileAttributesW@KERNEL32.DLL at 00000000-00004960-16475-626-0100459F Found reference to API CreateFileW@KERNEL32.DLL at 00000000-00004960-16475-656-01003940 Found reference to API DeleteFileW@KERNEL32.DLL at 00000000-00004960-16475-854-010039C3 Found reference to API RegDeleteKeyExW@KERNEL32.DLL at 00000000-00004960-16475-1027-00FE4F34 Found reference to API GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00004960-16475-1031-01004F5C Found reference to API CreateDirectoryW@KERNEL32.DLL at 00000000-00004960-16475-1180-010038C7 Found reference to API GetSystemWindowsDirectoryW@KERNEL32.DLL at 00000000-00004960-16475-1187-00FD87BE Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00004960-16475-1227-01006AD6 Found reference to API DllGetClassObject@WINTYPES.DLL at 00000000-00004960-16475-1238-00FEDA6A Found reference to API GetProcessId@KERNEL32.DLL at 00000000-00004960-16475-1527-01004B6E Found reference to API GetProcessId@KERNEL32.DLL at 00000000-00004960-16475-1543-01004B97 Found reference to API CreateToolhelp32Snapshot@KERNEL32.DLL at 00000000-00004960-16475-1545-01006182 Found reference to API NtQueryInformationProcess@NTDLL.DLL at 00000000-00004960-16475-1546-010062DF Found reference to API IsWow64Process@KERNEL32.DLL at 00000000-00004960-16475-1695-01006B03 Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00004960-16475-3776-01039E7C2e:T12f8,Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "Agent.exe") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "Agent.exe") Found api reference "CertGetNameStringA" (Indicator: "CertGetNameStringA"; File: "Agent.exe") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; File: "Agent.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "Agent.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "Agent.exe") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; File: "Agent.exe") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "Agent.exe") Found api reference "CryptMsgClose" (Indicator: "CryptMsgClose"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertSaveStore" (Indicator: "CertSaveStore"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertGetIssuerCertificateFromStore" (Indicator: "CertGetIssuerCertificateFromStore"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertSetCertificateContextProperty" (Indicator: "CertSetCertificateContextProperty"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertCompareCertificate" (Indicator: "CertCompareCertificate"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CryptImportPublicKeyInfo" (Indicator: "CryptImportPublicKeyInfo"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CryptAcquireCertificatePrivateKey" (Indicator: "CryptAcquireCertificatePrivateKey"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp")2f:T1133,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002316-13712-369-00969520 Assembly shows XOR instruction xor eax 03h in Stream UID: 00000000-00002316-13712-369-00969520 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002316-13712-369-00969520 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002316-13712-411-00967C10 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002316-13712-411-00967C10 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002316-13712-454-009668F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002316-13712-454-009668F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002316-13712-629-00916C97 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002316-13712-629-00916C97 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002316-13712-1913-00965110 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002316-13712-1913-00965110 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002316-13712-2912-0093C584 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-21-010178D4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-21-010178D4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-25-010139F7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-25-010139F7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-31-0101B245 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-31-0101B245 Assembly shows XOR instruction xor eax dword ptr [01054DB8h] in Stream UID: 00000000-00004960-16475-48-01012632 Assembly shows XOR instruction xor eax dword ptr [01054DB8h] in Stream UID: 00000000-00004960-16475-51-01012613 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-80-00FD3610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-80-00FD3610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-83-00FD45F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-83-00FD45F0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004960-16475-84-00FD52C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004960-16475-84-00FD52C0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004960-16475-85-00FD5D60 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004960-16475-85-00FD5D60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-184-0102CFB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-184-0102CFB0 Assembly shows XOR instruction xor eax dword ptr [01054DB8h] in Stream UID: 00000000-00004960-16475-192-0101901B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-232-0102CBE0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-232-0102CBE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-235-0102B880 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-236-0102B620 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-236-0102B620 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-254-0102D939 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-254-0102D939 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-263-0102D7F1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-263-0102D7F1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-277-0102A0D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-277-0102A0D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-324-0102A9E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004960-16475-324-0102A9E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004960-16475-326-0102904030:T5c2,Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002316.00000000.200103.03200000.00000004.mdmp, 00000000-00002316.00000001.202025.03200000.00000004.mdmp, 00000000-00002316.00000002.203946.03200000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003428.00000000.200443.C8970000.00000004.mdmp") Found string "7}\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003456.00000000.200397.79140000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003456.00000000.200397.79140000.00000004.mdmp") Found string "7}\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003716.00000000.200466.3A4E0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003716.00000000.200466.3A4E0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004240.00000000.200575.EDCA0000.00000004.mdmp, 00000000-00004240.00000001.202497.EDCA0000.00000004.mdmp, 00000000-00004240.00000002.204415.EDCA0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp")31:T38f1,Found XOR loop in file "ISSetup.dll" at offset 1347307; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1356647; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1356815; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1358283; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1362629; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1364885; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1364995; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1369099; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1370135; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1370629; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1371661; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1372305; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1376205; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1379649; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1383019; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1384435; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1386987; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1387119; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1389863; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1390849; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1391719; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1399231; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1400119; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1403363; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1415109; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1415281; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1417963; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 1419087; code bytes = 30d0 Found XOR loop in file "ISSetup.dll" at offset 21865; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 22502; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 430009; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 456441; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 641556; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 641577; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 641598; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 641667; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 641759; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 647840; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 676570; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 676706; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 1349727; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 1356847; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 1357285; code bytes = 33c1 Found XOR loop in file "ISSetup.dll" at offset 145579; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 842919; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 975354; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 989176; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1326487; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1328107; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1328307; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1331091; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1331391; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1332863; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1349518; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1369060; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1371622; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1372268; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1380944; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1382008; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1382980; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1384404; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1386948; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1387950; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1389850; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1391702; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1399216; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1400104; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1400610; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1404650; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1407402; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1408028; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1409460; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1410118; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1411254; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1411724; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1412390; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1415250; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1416186; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1416414; code bytes = 8030 Found XOR loop in file "ISSetup.dll" at offset 1419052; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 415115; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 580390; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 609664; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 617866; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 618086; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 618305; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 859633; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 861463; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 864937; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 865349; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 866011; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 869687; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 235664; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 235685; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 235706; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 235775; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 235867; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 258046; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 258182; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 386405; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 844663; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 845387; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 851085; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 852529; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 854441; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 856539; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 858194; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 860830; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 861444; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 862468; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 866760; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 868662; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 870700; code bytes = 8030 Found XOR loop in file "_isAA81.tmp" at offset 1440668; code bytes = 30d0 Found XOR loop in file "_isAA81.tmp" at offset 1443370; code bytes = 8030 Found XOR loop in file "_isAA81.tmp" at offset 1857388; code bytes = 8030 Found XOR loop in file "_isAA81.tmp" at offset 1859837; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 195790; code bytes = 30d0 Found XOR loop in file "isrAA01.tmp" at offset 211387; code bytes = 30d0 Found XOR loop in file "isrAA01.tmp" at offset 222148; code bytes = 30d0 Found XOR loop in file "isrAA01.tmp" at offset 239377; code bytes = 30d0 Found XOR loop in file "isrAA01.tmp" at offset 245804; code bytes = 30d0 Found XOR loop in file "isrAA01.tmp" at offset 327436; code bytes = 30d0 Found XOR loop in file "isrAA01.tmp" at offset 351899; code bytes = 30d0 Found XOR loop in file "isrAA01.tmp" at offset 118231; code bytes = 33c1 Found XOR loop in file "isrAA01.tmp" at offset 129580; code bytes = 33c1 Found XOR loop in file "isrAA01.tmp" at offset 191050; code bytes = 33c1 Found XOR loop in file "isrAA01.tmp" at offset 221897; code bytes = 33c1 Found XOR loop in file "isrAA01.tmp" at offset 336909; code bytes = 33c1 Found XOR loop in file "isrAA01.tmp" at offset 359584; code bytes = 33c1 Found XOR loop in file "isrAA01.tmp" at offset 412804; code bytes = 33c1 Found XOR loop in file "isrAA01.tmp" at offset 31893; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 167109; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 195531; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 195983; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 251227; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 374005; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 380833; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 413463; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 429820; code bytes = 8030 Found XOR loop in file "isrAA01.tmp" at offset 432269; code bytes = 8030 Found XOR loop in file "ageC0F8.tmp" at offset 110846; code bytes = 30d0 Found XOR loop in file "ageC0F8.tmp" at offset 121345; code bytes = 30d0 Found XOR loop in file "ageC0F8.tmp" at offset 124407; code bytes = 30d0 Found XOR loop in file "ageC0F8.tmp" at offset 134328; code bytes = 30d0 Found XOR loop in file "ageC0F8.tmp" at offset 137707; code bytes = 30d0 Found XOR loop in file "ageC0F8.tmp" at offset 265567; code bytes = 30d0 Found XOR loop in file "ageC0F8.tmp" at offset 38269; code bytes = 33c1 Found XOR loop in file "ageC0F8.tmp" at offset 38315; code bytes = 33c1 Found XOR loop in file "ageC0F8.tmp" at offset 100378; code bytes = 33c1 Found XOR loop in file "ageC0F8.tmp" at offset 100997; code bytes = 33c1 Found XOR loop in file "ageC0F8.tmp" at offset 258509; code bytes = 33c1 Found XOR loop in file "ageC0F8.tmp" at offset 264958; code bytes = 8030 Found XOR loop in file "ageC0F8.tmp" at offset 278246; code bytes = 8030 Found XOR loop in file "ageC0F8.tmp" at offset 281069; code bytes = 8030 Found XOR loop in file "ageC0F8.tmp" at offset 281316; code bytes = 8030 Found XOR loop in file "ISBA9DF.tmp" at offset 66968; code bytes = 33c1 Found XOR loop in file "ISBA9DF.tmp" at offset 47203; code bytes = 8030 Found XOR loop in file "ISBA9DF.tmp" at offset 159784; code bytes = 8030 Found XOR loop in file "ISBA9DF.tmp" at offset 161299; code bytes = 8030 Found XOR loop in file "ISBA9DF.tmp" at offset 164979; code bytes = 8030 Found XOR loop in file "ISBA9DF.tmp" at offset 176380; code bytes = 8030 Found XOR loop in file "ISBA9DF.tmp" at offset 178829; code bytes = 8030 Found XOR loop in file "dotA9CE.tmp" at offset 18172; code bytes = 8030 Found XOR loop in file "dotA9CE.tmp" at offset 20621; code bytes = 8030 Found XOR loop in file "Agent.exe" at offset 415115; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 580390; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 609664; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 617866; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 618086; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 618305; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 859633; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 861463; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 864937; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 865349; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 866011; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 869687; code bytes = 30d0 Found XOR loop in file "Agent.exe" at offset 235664; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 235685; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 235706; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 235775; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 235867; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 258046; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 258182; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 386405; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 844663; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 845387; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 851085; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 852529; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 854441; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 856539; code bytes = 33c1 Found XOR loop in file "Agent.exe" at offset 858194; code bytes = 8030 Found XOR loop in file "Agent.exe" at offset 860830; code bytes = 8030 Found XOR loop in file "Agent.exe" at offset 861444; code bytes = 8030 Found XOR loop in file "Agent.exe" at offset 862468; code bytes = 8030 Found XOR loop in file "Agent.exe" at offset 866760; code bytes = 8030 Found XOR loop in file "Agent.exe" at offset 868662; code bytes = 8030 Found XOR loop in file "Agent.exe" at offset 870700; code bytes = 803032:T413,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "Agent.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "Agent.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002316.00000001.202025.0097B000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.0103B000.00000002.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004960.00000000.200160.7304E000.00000002.mdmp")33:T413,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "Agent.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "Agent.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002316.00000001.202025.0097B000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.0103B000.00000002.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004960.00000000.200160.7304E000.00000002.mdmp")34:T5ac,"Agent.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00004960) "Agent.exe" called "GetWindowTextW" with parameter "UEMSAgent Setup is preparing the InstallShield Wizard, which will guide you through the rest of the setup process. Please wait." - (UID: 00000000-00004960) "Agent.exe" called "GetWindowTextW" with parameter "Installing" - (UID: 00000000-00004960) "Agent.exe" called "GetWindowTextW" with parameter "C:\...\Temp\agentInstallerComponent.exe" - (UID: 00000000-00004960) "Agent.exe" called "GetWindowTextW" with parameter "%WINDIR%\Temp\UEMSAgent.msi" - (UID: 00000000-00004960) "Agent.exe" called "GetWindowTextW" with parameter "%WINDIR%\Temp\UEMSAgent.mst" - (UID: 00000000-00004960) "agentInstallerComponent.exe" called "GetWindowTextW" with parameter "To continue installation, please enter the code you see below." - (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetWindowTextW" with parameter "3738" - (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetWindowTextW" with parameter "Type here:" - (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetWindowTextW" with parameter "Please enter the captcha to proceed." - (UID: 00000000-00006632)35:T161b,"Agent.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002316) "Agent.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000004007000000070000007f000000800000001ce2c40018f2f8000000000018f2f80006c87d7760868977ffffffff4861200300000000070000000010c500000000002cf2f80023a2d974ffffffffdc85ce7548f2f8002b8fb7750700000044f2f80048612003486120034861200300072103b8f2f8003986b775921e2003f8c797004986b775000000007cf2f8000200000002000000000000000000e3004861200302000000b7f2f80000000000a4f2f80066067d77d1140000921e2003f8c7970002000000140014006c9ee300b8f2f800bab1be7504bfae75b7f2f800e11a2a38ccf2f800456eb775f8c79700000091008cf7f8008cf7f800 (UID: 00000000-00002316) "Agent.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000200000000000200350dff80000000000200000000000200360dff8000000200368dff80028000000000000000b000000d007440328000000d007440303000000000044035c000000dd0044030b000000dc000000f060220340c6200303000000000000002000000000004403cc014403040b440300000000000b44030000000058dff80059167c77200000000000000080a221030000200314e0f8002800000000000000000000000500000002000000000020032000000000000000010000007cdff800ee137c7700000000ee137c770000000000000000f082b675f082b6750100000090dff8000683b6750000200300000000 (UID: 00000000-00002316) "Agent.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002316) "Agent.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002316) "Agent.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004960) "Agent.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000004007000000070000007f000000800000001c82620090f28f000000000090f28f0006c87d7760868977ffffffffc8faab00000000000700000000b0620000000000a4f28f0023a2d974ffffffffdc85ce75c0f28f002b8fb77507000000bcf28f00c8faab00c8faab00c8faab00300eac0030f38f003986b775f21fab00f8c703014986b77500000000f4f28f0002000000020000000000000000005500c8faab00020000002ff38f00000000001cf38f0066067d77d1140000f21fab00f8c7030102000000140014006c9e550030f38f00bab1be7504bfae752ff38f00efb87c0644f38f00456eb775f8c703010000fd0004f88f0004f88f00 (UID: 00000000-00004960) "Agent.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004960) "Agent.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004960)36:Taf9,"Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA"; Key: "PRODUCTGUID") "Agent.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MICROSOFT EDGE")37:T523,"Agent.exe" called "CreateDirectoryW" with parameter %TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1} (UID: 00000000-00002316) "Agent.exe" called "CreateDirectoryW" with parameter C:\Users\ (UID: 00000000-00002316) "Agent.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\ (UID: 00000000-00002316) "Agent.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\ (UID: 00000000-00002316) "Agent.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\ (UID: 00000000-00002316) "Agent.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00002316) "Agent.exe" called "CreateDirectoryW" with parameter %TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\ (UID: 00000000-00002316) "Agent.exe" called "CreateDirectoryW" with parameter %TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\ (UID: 00000000-00002316) "Agent.exe" called "CreateDirectoryW" with parameter C:\Users\ (UID: 00000000-00004960) "Agent.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\ (UID: 00000000-00004960) "Agent.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\ (UID: 00000000-00004960) "Agent.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\ (UID: 00000000-00004960) "Agent.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00004960)38:T661,"Agent.exe" called "CreateProcessW" with parameter "%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Agent.exe -package:"C:\Agent.exe" -no_selfdeleter -IS_" - (UID: 00000000-00002316) "Agent.exe" called "CreateProcessW" with parameter "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B57" - (UID: 00000000-00004960) "Agent.exe" called "CreateProcessW" with parameter "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA6" - (UID: 00000000-00004960) "Agent.exe" called "CreateProcessW" with parameter "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81E" - (UID: 00000000-00004960) "Agent.exe" called "CreateProcessW" with parameter "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9C" - (UID: 00000000-00004960) "Agent.exe" called "CreateProcessW" with parameter "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D20" - (UID: 00000000-00004960) "Agent.exe" called "CreateProcessW" with parameter "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{003" - (UID: 00000000-00004960) "Agent.exe" called "CreateProcessA" with parameter "%WINDIR%\SysWOW64\cmd.exe /C %WINDIR%\Temp\agentInstallerComponent.exe "C:\Agent.exe" 3 > %WINDIR%\Temp\DesktopCentralAgent.txt 2>&1" - (UID: 00000000-00004960) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\Temp\agentInstallerComponent.exe "C:\Agent.exe" 3" - (UID: 00000000-00005228)39:T4e3,"Agent.exe" called "LoadLibrary" with a parameter %TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\ISSetup.dll (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\ISRT.dll (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RICHED32.DLL (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isres_0x0409.dl (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isuser_0x0409.d (UID: 00000000-00004960) "Agent.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\AppHelp.dll (UID: 00000000-00004960)3a:Teda,"Agent.exe" called "MoveFileW" with parameter %TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.exe & %TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\Agent.exe (UID: 00000000-00002316) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setA95B.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setup.inx (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\InsA99B.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\Install.bat (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FonA9AC.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FontData.ini (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFA9AD.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFxData.ini (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\corA9BD.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\corecomp.ini (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotnetinstaller.exe (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9DE.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotnetinstaller.exe.config (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\StrAA00.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\StringTable_0x04 (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrAA01.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrt.dll (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\defAA40.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\default.pal (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA51.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isuser_0x0409.d (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA81.tmp & %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isres_0x0409.dl (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %WINDIR%\Temp\ageC0F8.tmp & %WINDIR%\Temp\agentInstallerComponent.exe (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %WINDIR%\Temp\UEMC195.tmp & %WINDIR%\Temp\UEMSAgent.msi (UID: 00000000-00004960) "Agent.exe" called "MoveFileW" with parameter %WINDIR%\Temp\UEMCEA6.tmp & %WINDIR%\Temp\UEMSAgent.mst (UID: 00000000-00004960)3b:T12b17,"Agent.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00002316) "Agent.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetProductSKU (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InstallEngineTypelib (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ImageList_Draw (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ImageList_AddMasked (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ImageList_Create (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ImageList_ReplaceIcon (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ImageList_Add (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ImageList_GetImageCount (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ImageList_Destroy (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipGetImageHeight (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromStream (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromFile (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromStreamICM (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromFileICM (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromResource (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCloneImage (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipGetImageWidth (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCreateHICONFromBitmap (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WritePrivateProfileSectionW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetPrivateProfileSectionW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetShortPathNameW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcpyW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcpynW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcatW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsBadWritePtr (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GlobalMemoryStatus (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FatalAppExitA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FreeResource (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetPrivateProfileSectionNamesA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetPrivateProfileStringA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetPrivateProfileIntA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcmpiA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcmpiW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetFileTime (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FindResourceW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LockResource (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcmpW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDateFormatW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTimeFormatW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FindResourceExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CompareFileTime (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetVersion (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InterlockedCompareExchange (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InterlockedExchange (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CopyRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter WaitForInputIdle (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CharUpperBuffW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetScrollInfo (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter PtInRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OffsetRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DrawFocusRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ShowScrollBar (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ScrollWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadBitmapW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetScrollPos (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateDialogIndirectParamW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MapDialogRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsDialogMessageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetActiveWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDlgItemTextW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MessageBeep (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RemovePropW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetPropW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetPropW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetClassNameW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InvalidateRgn (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjects (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ExitWindowsEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetDlgItemTextW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DrawIcon (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DrawTextW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InflateRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IntersectRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DestroyAcceleratorTable (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateAcceleratorTableW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ReleaseCapture (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetCapture (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDlgCtrlID (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetClassInfoExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FindWindowW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DrawFrameControl (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EnableWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter MoveToEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LineTo (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTextExtentPointW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreatePen (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EnumFontFamiliesExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateICW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter TextOutW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreatePatternBrush (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter DeleteMetaFile (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateDIBitmap (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreatePalette (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSystemPaletteEntries (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter PatBlt (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter PlayMetaFile (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RealizePalette (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetMapMode (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetMetaFileBitsEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetPixel (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter StretchBlt (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetStretchBltMode (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetViewportExtEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetViewportOrgEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetWindowExtEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetWindowOrgEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter UnrealizeObject (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter PrintDlgW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptVerifySignatureW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptSignHashW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptDeriveKey (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegCreateKeyW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegOverridePredefKey (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter EnumDependentServicesW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SHBrowseForFolderW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter OleLockRunning (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter ProgIDFromCLSID (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoGetInterfaceAndReleaseStream (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetRunningObjectTable (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CreateItemMoniker (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoLoadLibrary (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter UuidCreate (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter UuidToStringW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter UuidFromStringW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __CreateObjectContext (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetContextGUID (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsObject (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetProgress (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter _DoSprintf (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter _IsWow64 (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter _GetProcessorInfo (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsNTAdmin (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter IsPowerUser (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSystemDefaultLangID (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetUserDefaultLangID (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetSystemDefaultUILanguage (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter _SetupTraceWrite (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter _RegQueryKeyValue (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter _IsVirtualMachine (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter GetHandle (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetTextSub (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetReboot (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetFileRegistrar (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetLogDB (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetInfo (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetMainWindow (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetObjects (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter _ListCreate (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetMaintenanceMode (UID: 00000000-00004960) "Agent.exe" called "GetProcAddress" with a parameter __GetMaintOption (UID: 00000000-00004960) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005772) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003456) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005016) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003428) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003716) "ISBEW64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004240) "ISBEW64.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004240) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005228) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005228) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005228) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005228) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005228) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005228) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005228) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005228) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006632) "agentInstallerComponent.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006632)3c:T7d4,"ISSetup.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "ISSetup.dll" contains export function called "DllGetClassObject" at ordinal 2 "ISSetup.dll" contains export function called "DllRegisterServer" at ordinal 3 "ISSetup.dll" contains export function called "DllUnregisterServer" at ordinal 4 "ISSetup.dll" contains export function called "GetProductSKU" at ordinal 5 "ISSetup.dll" contains export function called "GetScriptEngine" at ordinal 6 "ISSetup.dll" contains export function called "InstallEngineTypelib" at ordinal 7 "ISSetup.dll" contains export function called "RemoveEngineTypelib" at ordinal 8 "ISSetup.dll" contains export function called "SuiteIsFeatureInstalled" at ordinal 9 "ISSetup.dll" contains export function called "SuiteStartupInstall" at ordinal 10 "isrAA01.tmp" contains export function called "AddIcon" at ordinal 108 "isrAA01.tmp" contains export function called "CallDLLFn" at ordinal 92 "isrAA01.tmp" contains export function called "ComponentViewCreateWindow" at ordinal 45 "isrAA01.tmp" contains export function called "ComponentViewDestroy" at ordinal 49 "isrAA01.tmp" contains export function called "ComponentViewRefresh" at ordinal 47 "isrAA01.tmp" contains export function called "ComponentViewSelectAll" at ordinal 48 "isrAA01.tmp" contains export function called "ComponentViewSetInfo" at ordinal 46 "isrAA01.tmp" contains export function called "ComponentViewSetInfoEx" at ordinal 147 "isrAA01.tmp" contains export function called "CreateFolder" at ordinal 109 "isrAA01.tmp" contains export function called "DeleteFolder" at ordinal 110 "isrAA01.tmp" contains export function called "DeleteIcon" at ordinal 114 "isrAA01.tmp" contains export function called "EnableHourGlass" at ordinal 197 "isrAA01.tmp" contains export function called "EnumFoldersItems" at ordinal 128 "isrAA01.tmp" contains export function called "GetCPUType" at ordinal 41 "isrAA01.tmp" contains export function called "GetFontSub" at ordinal 2123d:T556,":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp3e:T8f8,Process Agent.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2316:168:WilStaging_02" Process Agent.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2316:168:WilStaging_02" Process Agent.exe created mutex with name "Local\SM0:2316:168:WilStaging_02" Process Agent.exe created mutex with name "SM0:2316:168:WilStaging_02" Process Agent.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4960:168:WilStaging_02" Process Agent.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4960:168:WilStaging_02" Process Agent.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4960:64:WilError_01" Process Agent.exe created mutex with name "Local\SM0:4960:168:WilStaging_02" Process Agent.exe created mutex with name "SM0:4960:64:WilError_01" Process Agent.exe created mutex with name "SM0:4960:168:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5772:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5772:304:WilStaging_02" Process ISBEW64.exe created mutex with name "SM0:5772:304:WilStaging_02" Process ISBEW64.exe created mutex with name "Local\SM0:5772:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3456:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3456:304:WilStaging_02" Process ISBEW64.exe created mutex with name "SM0:3456:304:WilStaging_02" Process ISBEW64.exe created mutex with name "Local\SM0:3456:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5016:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5016:304:WilStaging_02" Process ISBEW64.exe created mutex with name "SM0:5016:304:WilStaging_02" Process ISBEW64.exe created mutex with name "Local\SM0:5016:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3428:304:WilStaging_02" Process ISBEW64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3428:304:WilStaging_02" Process ISBEW64.exe created mutex with name "Local\SM0:3428:304:WilStaging_02"3f:T475,Antivirus vendors marked dropped file "layout.bin" as clean (type is "data") Antivirus vendors marked dropped file "_isAA81.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "_isAA51.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"), Antivirus vendors marked dropped file "ageC0F8.tmp" as clean (type is "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"), Antivirus vendors marked dropped file "ISBA9DF.tmp" as clean (type is "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"), Antivirus vendors marked dropped file "dotA9CE.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "ISSetup.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "Agent.exe" as clean (type is "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "setup.inx" as clean (type is "data")40:T381d,"Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00002316.00000000.200103.03200000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002316.00000000.200103.03200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "SOFTWARE\InstallShield\24.0\Professional" in Source: 00000000-00002316.00000001.202025.0097B000.00000002.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00002316.00000001.202025.03200000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002316.00000001.202025.03200000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00002316.00000002.203946.03200000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002316.00000002.203946.03200000.00000004.mdmp "s\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00004240.00000000.200575.EDCA0000.00000004.mdmp "s\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00004240.00000001.202497.EDCA0000.00000004.mdmp "s\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00004240.00000002.204415.EDCA0000.00000004.mdmp "HARDWARE\DESCRIPTION\System\FloatingPointProcessor" in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v1.1.4322\" in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v2.0.50727\" in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\Full\v1.0.3705\1033\Microsoft .NET Framework Full v1.0.3705 (1033)\" in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00004960.00000000.200160.058D0000.00000004.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00004960.00000000.200160.058D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004960.00000000.200160.058D0000.00000004.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00004960.00000000.200160.058D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00004960.00000000.200160.10001000.00000040.mdmp "SOFTWARE\InstallShield\Cryptography\Trust" in Source: 00000000-00004960.00000000.200160.10001000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004960.00000000.200160.10001000.00000040.mdmp "Software\Classes" in Source: 00000000-00004960.00000000.200160.10001000.00000040.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00004960.00000000.200160.10001000.00000040.mdmp "Software\InstallShieldPendingOperation" in Source: 00000000-00004960.00000000.200160.10001000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information\" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "Software\Microsoft\InetStp" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "Software\InstallShieldPendingOperation" in Source: 00000000-00004960.00000000.200160.7304E000.00000002.mdmp "HARDWARE\DESCRIPTION\System\FloatingPointProcessor" in Source: 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v1.1.4322\" in Source: 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v2.0.50727\" in Source: 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}" in Source: 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\Full\v1.0.3705\1033\Microsoft .NET Framework Full v1.0.3705 (1033)\" in Source: 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp "Software\\\\" in Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00004960.00000001.202079.10001000.00000040.mdmp "SOFTWARE\InstallShield\Cryptography\Trust" in Source: 00000000-00004960.00000001.202079.10001000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004960.00000001.202079.10001000.00000040.mdmp "Software\Classes" in Source: 00000000-00004960.00000001.202079.10001000.00000040.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00004960.00000001.202079.10001000.00000040.mdmp "Software\InstallShieldPendingOperation" in Source: 00000000-00004960.00000001.202079.10001000.00000040.mdmp "HARDWARE\DESCRIPTION\System\FloatingPointProcessor" in Source: 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v1.1.4322\" in Source: 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\NDP\v2.0.50727\" in Source: 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}" in Source: 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp "Software\Microsoft\NET Framework Setup\Full\v1.0.3705\1033\Microsoft .NET Framework Full v1.0.3705 (1033)\" in Source: 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SOFTWARE\InstallShield\24.0\Professional" in Source: 00000000-00004960.00000002.203999.0103B000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00004960.00000002.203999.058D0000.00000004.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00004960.00000002.203999.058D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004960.00000002.203999.058D0000.00000004.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00004960.00000002.203999.058D0000.00000004.mdmp "Software\\\\" in Source: 00000000-00004960.00000002.203999.058D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Setup" in Source: 00000000-00004960.00000002.203999.05A60000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004960.00000002.203999.05A60000.00000004.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00004960.00000002.203999.05A60000.00000004.mdmp "Software\Microsoft\Internet Explorer" in Source: 00000000-00004960.00000002.203999.05A60000.00000004.mdmp "ISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004960.00000002.203999.05A60000.00000004.mdmp "Software\\\\" in Source: 00000000-00004960.00000002.203999.05A60000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00005772.00000000.200367.BDF10000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00005772.00000001.202289.BDF10000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00005772.00000002.204207.BDF10000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006632.00000000.200888.02EF0000.00000004.mdmp "SOFTWARE\AdventNet\DesktopCentral\AgentLauncher" in Source: 00000000-00006632.00000001.202806.00E42000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006632.00000001.202806.02EF0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006632.00000002.204728.02EF0000.00000004.mdmp41:Tdaf,"Agent.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73130000 "Agent.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d90000 "Agent.exe" loaded module "RPCRT4.DLL" at base 74a70000 "Agent.exe" loaded module "KERNEL32.DLL" at base 74410000 "Agent.exe" loaded module "NTDLL.DLL" at base 77780000 "Agent.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 734b0000 "Agent.exe" loaded module "%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\ISSETUP.DLL" at base 72f80000 "Agent.exe" loaded module "COMCTL32.DLL" at base 73290000 "Agent.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77270000 "Agent.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74680000 "Agent.exe" loaded module "OLEAUT32.DLL" at base 75460000 "Agent.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74500000 "Agent.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74500000 "Agent.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 75ae0000 "Agent.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73f60000 "Agent.exe" loaded module "KERNEL32" at base 74410000 "Agent.exe" loaded module "USER32" at base 74500000 "Agent.exe" loaded module "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\ISRT.DLL" at base 10000000 "Agent.exe" loaded module "%WINDIR%\SYSTEM32\RICHED32.DLL" at base 72b50000 "Agent.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 75460000 "Agent.exe" loaded module "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_ISRES_0X0409.DLL" at base 7780000 "Agent.exe" loaded module "%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_ISUSER_0X0409.DLL" at base 7950000 "Agent.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 725a0000 "ISBEW64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff25cc0000 "ISBEW64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff3f5d0000 "ISBEW64.exe" loaded module "KERNEL32.DLL" at base 7fff43510000 "ISBEW64.exe" loaded module "RPCRT4.DLL" at base 7fff44730000 "ISBEW64.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7fff441a0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73130000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74410000 "cmd.exe" loaded module "NTDLL.DLL" at base 77780000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 734b0000 "agentInstallerComponent.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73130000 "agentInstallerComponent.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d90000 "agentInstallerComponent.exe" loaded module "COMCTL32.DLL" at base 73290000 "agentInstallerComponent.exe" loaded module "KERNEL32.DLL" at base 74410000 "agentInstallerComponent.exe" loaded module "OLEAUT32.DLL" at base 75460000 "agentInstallerComponent.exe" loaded module "RPCRT4.DLL" at base 74a70000 "agentInstallerComponent.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74500000 "agentInstallerComponent.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74500000 "agentInstallerComponent.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 75ae0000 "agentInstallerComponent.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77270000 "agentInstallerComponent.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7468000042:T52a,"Agent.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Agent.exe" was detected as "Microsoft Linker" and name: "Linker" "ISSetup.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ISSetup.dll" was detected as "Microsoft Linker" and name: "Linker" "setup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "setup.exe" was detected as "Microsoft Linker" and name: "Linker" "_isAA81.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_isAA81.tmp" was detected as "Microsoft Linker" and name: "Linker" "_isAA51.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_isAA51.tmp" was detected as "Microsoft Linker" and name: "Linker" "isrAA01.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "isrAA01.tmp" was detected as "Microsoft Linker" and name: "Linker" "ageC0F8.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ageC0F8.tmp" was detected as "Microsoft Linker" and name: "Linker" "ISBA9DF.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ISBA9DF.tmp" was detected as "Microsoft Linker" and name: "Linker" "dotA9CE.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "dotA9CE.tmp" was detected as "Microsoft Linker" and name: "Linker"43:T1637,"Agent.exe" file has an entrypoint instructions - "call 0x4486db,jmp 0x441ba0,push ebp,mov ebp, esp,xor edx, edx,mov eax, edx,cmp dword ptr [ebp + 0xc], eax,jbe 0x441d3e,mov ecx, dword ptr [ebp + 8],cmp word ptr [ecx], dx,je 0x441d3e,inc eax,add ecx, 2,cmp eax, dword ptr [ebp + 0xc],jb 0x441d30,pop ebp,ret ,mov ecx, dword ptr [esp + 0xc],push edi,test ecx, ecx,je 0x441ddf,push esi,push ebx,mov ebx, ecx,mov esi, dword ptr [esp + 0x14],test esi, 3,mov edi, dword ptr [esp + 0x10],jne 0x441d6c,shr ecx, 2,jne 0x441def,jmp 0x441d93,mov al, byte ptr [esi],add esi, 1,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,je 0x441da6," "ISSetup.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100aa3d8,call 0x100b23da,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100aa3ed,add esp, 0xc,pop ebp,ret 0xc,push 0xc,push 0x10116eb8,call 0x100ad1a0,xor eax, eax,inc eax,mov esi, dword ptr [ebp + 0xc],test esi, esi,jne 0x100aa40f,cmp dword ptr [0x1013f6d4], esi,je 0x100aa4f3,and dword ptr [ebp - 4], 0,cmp esi, 1,je 0x100aa41d,cmp esi, 2,jne 0x100aa452,mov ecx, dword ptr [0x100e9708],test ecx, ecx,je 0x100aa433,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8]," "setup.exe" file has an entrypoint instructions - "call 0x4486db,jmp 0x441ba0,push ebp,mov ebp, esp,xor edx, edx,mov eax, edx,cmp dword ptr [ebp + 0xc], eax,jbe 0x441d3e,mov ecx, dword ptr [ebp + 8],cmp word ptr [ecx], dx,je 0x441d3e,inc eax,add ecx, 2,cmp eax, dword ptr [ebp + 0xc],jb 0x441d30,pop ebp,ret ,mov ecx, dword ptr [esp + 0xc],push edi,test ecx, ecx,je 0x441ddf,push esi,push ebx,mov ebx, ecx,mov esi, dword ptr [esp + 0x14],test esi, 3,mov edi, dword ptr [esp + 0x10],jne 0x441d6c,shr ecx, 2,jne 0x441def,jmp 0x441d93,mov al, byte ptr [esi],add esi, 1,mov byte ptr [edi], al,add edi, 1,sub ecx, 1,je 0x441da6," "_isAA81.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ecx,mov dword ptr [ebp - 4], 1,cmp dword ptr [ebp + 0xc], 0,jne 0x100011a1,cmp dword ptr [0x10031a78], 0,jne 0x100011a1,xor eax, eax,jmp 0x1000126d,cmp dword ptr [ebp + 0xc], 1,je 0x100011ad,cmp dword ptr [ebp + 0xc], 2,jne 0x100011ef,cmp dword ptr [0x10033610], 0,je 0x100011cb,mov eax, dword ptr [ebp + 0x10],push eax,mov ecx, dword ptr [ebp + 0xc],push ecx,mov edx, dword ptr [ebp + 8],push edx,call dword ptr [0x10033610],mov dword ptr [ebp - 4], eax,cmp dword ptr [ebp - 4], 0,je 0x100011e5,mov eax, dword ptr [ebp + 0x10],push eax,mov ecx, dword ptr [ebp + 0xc],push ecx,mov edx, dword ptr [ebp + 8],push edx,call 0x10001040," "_isAA51.tmp" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "isrAA01.tmp" file has an entrypoint instructions - "mov eax, 0x101122fc,push eax,push dword ptr fs:[0],mov dword ptr fs:[0], esp,xor eax, eax,mov dword ptr [eax], ecx,push eax,inc ebp,inc ebx,outsd dx, dword ptr [esi],insd dword ptr es:[edi], dx,jo 0x10111a5a,arpl word ptr [edx + esi], si,add byte ptr [eax], al,add byte ptr [eax], cl,loope 0x10111a4b,add dword ptr [ebp], edx,mov ebp, esp,push ebx,push edi,push esi,push dword ptr [ebp + 0xc],ret ,push es,or al, ch,pop es,add esp, dword ptr [ebx],pop esi,pop edi,pop ebx,leave ,ret 0x1f5,sbb byte ptr [ebx - 0x43030b3c], al,cmp dword ptr [edi - 0x51dfdb8c], ecx,jl 0x101119c7,inc eax,cmp word ptr [esi], 0x434a,prefetchnta byte ptr [ebp - 0x7cb7fd63]," "ageC0F8.tmp" file has an entrypoint instructions - "call 0x423cbc,jmp 0x41856c,call 0x4230a2,test eax, eax,je 0x4186e8,push 0x16,call 0x4230af,pop ecx,test byte ptr [0x43c4ec], 2,je 0x418702,push 1,push 0x40000015,push 3,call 0x41c633,add esp, 0xc,push 3,call 0x418471,int3 ,mov edi, edi,push ebp,mov ebp, esp,mov ecx, dword ptr [ebp + 0xc],mov eax, dword ptr [0x43c4ec],mov edx, dword ptr [ebp + 8],and edx, dword ptr [ebp + 0xc],not ecx,and ecx, eax,or ecx, edx,mov dword ptr [0x43c4ec], ecx,pop ebp,ret ,int3 ,int3 ,int3 ,int3 ,int3 ," "ISBA9DF.tmp" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140011128,add rsp, 0x28,jmp 0x14000b958,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],mov r11, rcx,cmp r8, 8,jb 0x14000bbb4,movzx edx, dl,bt dword ptr [rip + 0x1ccf8], 1,jae 0x14000bb64,push rdi,mov rdi, rcx,mov eax, edx,mov rcx, r8,rep stosb byte ptr [rdi], al,pop rdi,jmp 0x14000bbc3,movabs r9, 0x101010101010101,imul rdx, r9," "dotA9CE.tmp" file has an entrypoint instructions - "jmp dword ptr [0x11002000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"44:T6e8,"Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Agent.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE\EN-US"; Key: "TRANSIENTLANGID") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AA") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AA") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AA-ET") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AA-ET") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AA-DJ") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AA-DJ") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AA-ER") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AA-ER") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AF") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AF") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AF-ZA") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AF-ZA") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AF-NA") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AF-NA") "Agent.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AGQ")45:T4e5,Spawned process "Agent.exe" with commandline "-package:"C:\\Agent.exe" -no_selfdeleter -IS_temp -media_path:"% ..." (UID: 00000000-00004960), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B5716001-2C7F-484B-8EE8- ..." (UID: 00000000-00005772), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA68DDAF-F450-428D-B77C- ..." (UID: 00000000-00003456), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81E16544-A719-4A97-B44E- ..." (UID: 00000000-00005016), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9C148AA-93A7-48D2-97C2- ..." (UID: 00000000-00003428), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D20B644D-6DE2-4732-90AB- ..." (UID: 00000000-00003716), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0037F871-8682-4248-A4B8- ..." (UID: 00000000-00004240), Spawned process "cmd.exe" with commandline "/C %WINDIR%\\Temp\\agentInstallerComponent.exe "C:\\Agent.exe" 3 ..." (UID: 00000000-00005228), Spawned process "agentInstallerComponent.exe" with commandline ""C:\\Agent.exe" 3" (UID: 00000000-00006632)46:T4e5,Spawned process "Agent.exe" with commandline "-package:"C:\\Agent.exe" -no_selfdeleter -IS_temp -media_path:"% ..." (UID: 00000000-00004960), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B5716001-2C7F-484B-8EE8- ..." (UID: 00000000-00005772), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA68DDAF-F450-428D-B77C- ..." (UID: 00000000-00003456), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81E16544-A719-4A97-B44E- ..." (UID: 00000000-00005016), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9C148AA-93A7-48D2-97C2- ..." (UID: 00000000-00003428), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D20B644D-6DE2-4732-90AB- ..." (UID: 00000000-00003716), Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0037F871-8682-4248-A4B8- ..." (UID: 00000000-00004240), Spawned process "cmd.exe" with commandline "/C %WINDIR%\\Temp\\agentInstallerComponent.exe "C:\\Agent.exe" 3 ..." (UID: 00000000-00005228), Spawned process "agentInstallerComponent.exe" with commandline ""C:\\Agent.exe" 3" (UID: 00000000-00006632)47:T184c,"ISSetup.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\ISSetup.dll]- [targetUID: 00000000-00002316] "setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.exe]- [targetUID: 00000000-00002316] "layout.bin" has type "data"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\layout.bin]- [targetUID: 00000000-00002316] "UEMC195.tmp" has type "Composite Document File V2 Document Can't read SAT"- Location: [%WINDIR%\Temp\UEMC195.tmp]- [targetUID: 00000000-00004960] "_isAA81.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA81.tmp]- [targetUID: 00000000-00004960] "_isAA51.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA51.tmp]- [targetUID: 00000000-00004960] "data1.cab" has type "InstallShield CAB version 0x4000960 ]b 1432048884 files"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\data1.cab]- [targetUID: 00000000-00002316] "isrAA01.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 PECompact2 compressed 3 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrAA01.tmp]- [targetUID: 00000000-00004960] "ageC0F8.tmp" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%WINDIR%\Temp\ageC0F8.tmp]- [targetUID: 00000000-00004960] "setA95B.tmp" has type "data"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setA95B.tmp]- [targetUID: 00000000-00004960] "ISBA9DF.tmp" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp]- [targetUID: 00000000-00004960] "corA9BD.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\corA9BD.tmp]- [targetUID: 00000000-00004960] "dotA9CE.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp]- [targetUID: 00000000-00004960] "0x0409.ini" has type "Unicode text UTF-16 little-endian text with very long lines (308) with CRLF line terminators"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\0x0409.ini]- [targetUID: 00000000-00002316] "UEMCEA6.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.3 Code page: 1252 Title: DesktopCentralAgent Author: desktopcentral-support@manageengine.com Create Time/Date: Mon Jun 21 07:00:00 1999 Name of Creating Application: Windows Installer Security: 1 Template: Intel;1033 Last Saved By: Intel;1033 Revision Number: {6AD2231F-FF48-4D59-AC26-405AFAE23DB7}6.0.3;{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}10.0.50.W;{384F2A8D-59B9-40BC-ABF7-C56C38753B33} Number of Pages: 200 Number of Characters: 65536"- Location: [%WINDIR%\Temp\UEMCEA6.tmp]- [targetUID: 00000000-00004960] "data1.hdr" has type "InstallShield setup header version 0x4000960 descriptor size 0x2483 ]b 28 files"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\data1.hdr]- [targetUID: 00000000-00002316] "DCAgentServerInfo.json" has type "JSON text data"- Location: [%WINDIR%\Temp\DCAgentServerInfo.json]- [targetUID: 00000000-00006632] "StrAA00.tmp" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\StrAA00.tmp]- [targetUID: 00000000-00004960] "setup.ini" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.ini]- [targetUID: 00000000-00002316] "defAA40.tmp" has type "RIFF (little-endian) data palette 1168 bytes data size 1028 256 entries extra bytes 0x6f66666c"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\defAA40.tmp]- [targetUID: 00000000-00004960] "dotA9DE.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9DE.tmp]- [targetUID: 00000000-00004960] "InsA99B.tmp" has type "ASCII text"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\InsA99B.tmp]- [targetUID: 00000000-00004960] "DIFA9AD.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFA9AD.tmp]- [targetUID: 00000000-00004960] "DesktopCentralAgent_DC.txt" has type "ASCII text with CRLF line terminators"- Location: [%WINDIR%\Temp\DesktopCentralAgent_DC.txt]- [targetUID: 00000000-00004960] "FonA9AC.tmp" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FonA9AC.tmp]- [targetUID: 00000000-00004960] "ISSetup.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\ISSetup.dll]- [targetUID: 00000000-00002316] "Agent.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Agent.exe]- [targetUID: 00000000-00002316] "setup.inx" has type "data"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.inx]- [targetUID: 00000000-00002316] "0x0409.ini" has type "Unicode text UTF-16 little-endian text with very long lines (308) with CRLF line terminators"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\0x0409.ini]- [targetUID: 00000000-00002316] "setup.ini" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\setup.ini]- [targetUID: 00000000-00002316]48:Tc47,"UEMC195.tmp" has type "Composite Document File V2 Document Can't read SAT" - Location: [%WINDIR%\Temp\UEMC195.tmp] "_isAA81.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA81.tmp] "_isAA51.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA51.tmp] "isrAA01.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 PECompact2 compressed 3 sections" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrAA01.tmp] "ageC0F8.tmp" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections" - Location: [%WINDIR%\Temp\ageC0F8.tmp] "setA95B.tmp" has type "data" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setA95B.tmp] "ISBA9DF.tmp" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp] "corA9BD.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\corA9BD.tmp] "dotA9CE.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp] "UEMCEA6.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.3 Code page: 1252 Title: DesktopCentralAgent Author: desktopcentral-support@manageengine.com Create Time/Date: Mon Jun 21 07:00:00 1999 Name of Creating Application: Windows Installer Security: 1 Template: Intel;1033 Last Saved By: Intel;1033 Revision Number: {6AD2231F-FF48-4D59-AC26-405AFAE23DB7}6.0.3;{6AD2231F-FF48-4D59-AC26-405AFAE23DB7}10.0.50.W;{384F2A8D-59B9-40BC-ABF7-C56C38753B33} Number of Pages: 200 Number of Characters: 65536" - Location: [%WINDIR%\Temp\UEMCEA6.tmp] "StrAA00.tmp" has type "Unicode text UTF-16 little-endian text with CRLF line terminators" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\StrAA00.tmp] "defAA40.tmp" has type "RIFF (little-endian) data palette 1168 bytes data size 1028 256 entries extra bytes 0x6f66666c" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\defAA40.tmp] "dotA9DE.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9DE.tmp] "InsA99B.tmp" has type "ASCII text" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\InsA99B.tmp] "DIFA9AD.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFA9AD.tmp] "FonA9AC.tmp" has type "ASCII text with CRLF line terminators" - Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FonA9AC.tmp]49:T549,"Agent.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "Agent.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "")4a:Taec,"Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "AGENT.EXE"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "AGENT"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "")4b:T4c2,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to query volume size Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)4c:T654,"Agent.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Agent.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Agent.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Agent.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Agent.exe" trying to access non-existent file "C:\MSVCP140.dll" "Agent.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Agent.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Agent.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Agent.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\AGENT.EXE" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\FLTLIB.DLL" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\MSVCP140.DLL" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\MSVCP140.dll" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\VCRUNTIME140.DLL" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\VCRUNTIME140.dll" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\CRYPTSP.DLL"4d:T9bf,"Agent.exe" trying to access non-existent file "C:\AGENT.EXE.LOCAL" "Agent.exe" trying to access non-existent file "C:\Agent.exe.Local\" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\DISK1" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\SETUP.INI" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\AGENT.EXE.LOCAL" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Agent.exe.Local\" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\0X0409.INI" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\SETUP.BMP" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\SETUP.GIF" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\A8BE.TMP" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\SETUP.INX" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setup.inx" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\SETA95B.TMP" "Agent.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setA95B.tmp"4e:T48b,Found reference to API "The request to connect and log on to an FTP server could not be completed because the supplied user name is incorrect." (Indicator: " connect "; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp") Found reference to API "The request to connect and log on to an FTP server could not be completed because the supplied password is incorrect." (Indicator: " connect "; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp") Found reference to API "The attempt to connect to the server failed." (Indicator: " connect "; Source: "00000000-00004960.00000000.200160.058D0000.00000004.mdmp, 00000000-00004960.00000002.203999.058D0000.00000004.mdmp") Found reference to API "The request to connect and log on to an FTP server failed." (Indicator: " connect "; Source: "00000000-00004960.00000000.200160.058D0000.00000004.mdmp, 00000000-00004960.00000002.203999.058D0000.00000004.mdmp")4f:T2fe6,Found URL "http://www.installshield.com/isetup/proerrorcentral.asp?errorcode=%d" - Source: "00000000-00002316.00000000.200103.03200000.00000004.mdmp") Found URL "http://www.manageengine.com" - Source: "00000000-00002316.00000000.200103.03200000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002316.00000000.200103.03200000.00000004.mdmp") Found URL "http://0x%04x.initahomafontnamepropertiesfontsize123.tmptempkernel32.dll>%s" - Source: "00000000-00002316.00000001.202025.0097B000.00000002.mdmp") Found URL "https://delayedstart:tempdisk1folder:extract_all:runfromtempis_tempautono_enginemedia_path:installfromweb:is_originallauncher:hide_progresshide_splashhide_usdrebootpackage:no_deleterno_selfdeleterclone_waitshow_eval_msgshow_beta_msgshow_err_dlgshow_err_msgshow_err_msg_invalid_identityscriptdrivenstartupproductproductcodeproductguidmediaformatlogmodesplashtimealluserssmallprogressshowpassworddialogcheckmd5companynamecompanyurlskinhttp://www.installshield.com/isetup/proerrorcentral.asp?errorcode=%d" - Source: "00000000-00002316.00000001.202025.0097B000.00000002.mdmp") Found URL "ftp://file://toys::file_lite.cabdatadata1.cabtoys::file" - Source: "00000000-00002316.00000001.202025.0097B000.00000002.mdmp") Found URL "http://www.installshield.com/isetup/proerrorcentral.asp?errorcode=%d" - Source: "00000000-00002316.00000001.202025.03200000.00000004.mdmp") Found URL "http://www.manageengine.com" - Source: "00000000-00002316.00000001.202025.03200000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002316.00000001.202025.03200000.00000004.mdmp") Found URL "http://www.installshield.com/isetup/proerrorcentral.asp?errorcode=%d" - Source: "00000000-00002316.00000002.203946.03200000.00000004.mdmp") Found URL "http://www.manageengine.com" - Source: "00000000-00002316.00000002.203946.03200000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002316.00000002.203946.03200000.00000004.mdmp") Found URL "http://www.manageengine.comstalshield.com/isetup/proerrorcentral.asp?errorcode=%d" - Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp") Found URL "http://www.installshield.com/isetup/proerrorcentral.asp?errorcode=%d" - Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp") Found URL "http://www.manageengine.comsetup.inxinstall.batfontdata.inidifxdata.inicorecomp.inidotnetinstaller.exedotnetinstaller.exe.configisbew64.exestringtable_0x0409.ipsisrt.dlldefault.pal_isuser_0x0409.dll_isres_0x0409.dlllayout.bindata1.hdrdata1.cabsetup.exeissetup.dll0x0409.inisetup.iniagentinstallercomponent.exeuemsagent.msiuemsagent.msthttp://deviis4.installshield.com/netnirvana/0,,1" - Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp") Found URL "https://installsuccesslastdllerrorlanguage.dllmouse.drvsystem.ininetwork.drvisfuncbeginisrt.dllmscorlib.dll1.0.3705.2881.0.3705.60180x%.04lx1.0.3705.209difxlogcallbackdifxlogcallbackisrt.dllisfuncendisfuncendpszmfgnamesetup.inisuiteextensionenterdiskenterdiskeinfpaenterdiskpszproductnameenterdiskenterdiskenterdiskeinfpaenterdisk" - Source: "00000000-00004960.00000000.200160.058D0000.00000004.mdmp") Found URL "https://oys::fileb&rhprogressdlgms" - Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp") Found URL "ftp://ir=%screatedirresult=%s" - Source: "00000000-00004960.00000000.200160.10001000.00000040.mdmp") Found URL "https://ftp://file://toys::filefile=%s" - Source: "00000000-00004960.00000000.200160.7304E000.00000002.mdmp") Found URL "http://www.installshield.com/isetup/proerrorcentral.asp?errorcode=%d" - Source: "00000000-00004960.00000000.200160.7304E000.00000002.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00004960.00000000.200160.730A5000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00004960.00000000.200160.730A5000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn%s" - Source: "00000000-00004960.00000002.203999.0103B000.00000002.mdmp") Found URL "https://elayedstart:tempdisk1folder:extract_all:runfromtempis_tempautono_enginemedia_path:installfromweb:is_originallauncher:hide_progresshide_splashhide_usdrebootpackage:no_deleterno_selfdeleterclone_waitshow_eval_msgshow_beta_msgshow_err_dlgshow_err_msgshow_err_msg_invalid_identityscriptdrivenstartupproductproductcodeproductguidmediaformatlogmodesplashtimealluserssmallprogressshowpassworddialogcheckmd5companynamecompanyurlskinhttp://www.installshield.com/isetup/proerrorcentral.asp?errorcode=%d" - Source: "00000000-00004960.00000002.203999.0103B000.00000002.mdmp") Found URL "ftp://file://toys::file_lite.cabdatadata1.cabtoys::file" - Source: "00000000-00004960.00000002.203999.0103B000.00000002.mdmp") Found URL "https://installsuccesslastdllerrorlanguage.dllmouse.drvsystem.ininetwork.drvisfuncbeginisrt.dllmscorlib.dll1.0.3705.2881.0.3705.60180x%.04lx1.0.3705.209difxlogcallbackdifxlogcallbackisrt.dllisfuncendisfuncendpszmfgnamesetup.inisuiteextensionenterdiskenterdiskeinfpaenterdiskpszproductnameenterdiskenterdiskenterdiskeinfpaenterdisk" - Source: "00000000-00004960.00000002.203999.058D0000.00000004.mdmp") Found URL "http://www.manageengine.comstandard_selected_languagemicrosoft.visualbasic.dlls" - Source: "00000000-00004960.00000002.203999.05A60000.00000004.mdmp") Found URL "http://www.manageengine.comesult=%s" - Source: "00000000-00004960.00000002.203999.05A60000.00000004.mdmp") Found URL "https://isfuncend0x%.04lx1.0.3705.6018pszproductname1.0.3705.209_r_a_p_.tmpisrt.dllisfuncendsuiteextensionlastdllerror1.0.3705.288installsuccesssetup.iniisrt.dlldifxlogcallbackdifxlogcallbackpszmfgnameisfuncbeginmscorlib.dll_r_a_p_.tmpenterdiskenterdiskenterdiskenterdiskenterpasswordenterpasswordenterdiskenterpasswordenterpasswordenterdiskenterdiskenterdiskenterpasswordenterpasswordenterpasswordenterpasswordenterpasswordenterdiskenterpasswordenterdiskenterpasswordenterpasswordsdfinishenterpasswordenterpasswordenterdiskenterdiskselectdirisfuncbeginmessageboxsprintfboxmessageboxbootoptionselectdirselectdirmessageboxbootoptionsprintfboxnyearmonthnhourminnhourminsdfinishrebootuser.paldefault.pal" - Source: "00000000-00004960.00000002.203999.05A60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004960.00000002.203999.730A5000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004960.00000002.203999.730A5000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr103,0*0(" - Source: "00000000-00004960.00000002.203999.730A5000.00000004.mdmp") Found URL "http://crl.globalsign.com/root.crl0g@0>0<0402&https://www.globalsign.com/repository/0oyvp_0l1" - Source: "00000000-00004960.00000002.203999.730A5000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/rootr30;/http://secure.globalsign.com/cacert/root-r3.crt06/0-0+%http://crl.globalsign.com/root-r3.crl0g@0>0<0402&https://www.globalsign.com/repository/0" - Source: "00000000-00004960.00000002.203999.730A5000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/codesigningrootr450f:http://secure.globalsign.com/cacert/codesigningrootr45.crt0a:08060http://crl.globalsign.com/codesigningrootr45.crl0vo0m0a20402&https://www.globalsign.com/repository/08i_a@glg&emky,x67d_&p+r)5sglobalsign" - Source: "00000000-00004960.00000002.203999.730A5000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=1http://ocsp.globalsign.com/gsgccr45codesignca20200vo0m0a20402&https://www.globalsign.com/repository/0>0<0:4http://crl.globalsign.com/gsgccr45codesignca2020.crl0!gdv" - Source: "00000000-00004960.00000002.203999.730A5000.00000004.mdmp")50:T5c6,Found string "+ncalrpc:[OLE27958125EA44E360E2BF9BA63D2A]" (Indicator: "ncalrpc"; Source: "00000000-00004240.00000000.200575.EDCA0000.00000004.mdmp, 00000000-00004240.00000001.202497.EDCA0000.00000004.mdmp, 00000000-00004240.00000002.204415.EDCA0000.00000004.mdmp") Found string "+ncalrpc:[OLEA309C04E9AE1A0E702723A16D452]" (Indicator: "ncalrpc"; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp") Found string "+ncalrpc:[OLE26DD5ED0D7563594E89FB5E214E6]" (Indicator: "ncalrpc"; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000000.200160.058D0000.00000004.mdmp, 00000000-00004960.00000002.203999.058D0000.00000004.mdmp") Found string "+ncalrpc:[OLE450C8045BC792F9B6918BE4EA209]" (Indicator: "ncalrpc"; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000000.200160.058D0000.00000004.mdmp, 00000000-00004960.00000002.203999.058D0000.00000004.mdmp") Found string "+ncalrpc:[OLE1697E7D7514490FECAB0FEEC7362]" (Indicator: "ncalrpc"; Source: "00000000-00004960.00000000.200160.058D0000.00000004.mdmp, 00000000-00004960.00000002.203999.058D0000.00000004.mdmp") Found string "+ncalrpc:[OLEAC44F7EAAF6C126CDB5955C06758]" (Indicator: "ncalrpc"; Source: "00000000-00004960.00000000.200160.058D0000.00000004.mdmp, 00000000-00004960.00000002.203999.058D0000.00000004.mdmp")51:T561,"Agent.exe" called "FindFirstFileW" with parameter C:\Agent.exe (UID: 00000000-00002316) "Agent.exe" called "FindFirstFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\ISRT.dll (UID: 00000000-00004960) "Agent.exe" called "FindFirstFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isres_0x0409.dl (UID: 00000000-00004960) "Agent.exe" called "FindFirstFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isuser_0x0409.d (UID: 00000000-00004960) "Agent.exe" called "FindFirstFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\*0409*.ips (UID: 00000000-00004960) "Agent.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\agentInstallerComponent.exe (UID: 00000000-00004960) "Agent.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\UEMSAgent.mst (UID: 00000000-00004960) "Agent.exe" called "FindFirstFileW" with parameter %WINDIR%\Temp\UEMSAgent.msi (UID: 00000000-00004960) "Agent.exe" called "FindFirstFileW" with parameter %TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\bbrd* (UID: 00000000-00004960) "Agent.exe" called "FindFirstFileW" with parameter C:\Agent.exe (UID: 00000000-00004960)52:T9d2,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002316.00000000.200103.03200000.00000004.mdmp, 00000000-00002316.00000001.202025.03200000.00000004.mdmp, 00000000-00002316.00000002.203946.03200000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003428.00000000.200443.C8970000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Indicator: "\Device\"; Source: "00000000-00003428.00000000.200443.C8970000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003456.00000000.200397.79140000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Indicator: "\Device\"; Source: "00000000-00003456.00000000.200397.79140000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003716.00000000.200466.3A4E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Indicator: "\Device\"; Source: "00000000-00003716.00000000.200466.3A4E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.200575.EDCA0000.00000004.mdmp, 00000000-00004240.00000001.202497.EDCA0000.00000004.mdmp, 00000000-00004240.00000002.204415.EDCA0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Indicator: "\Device\"; Source: "00000000-00004240.00000000.200575.EDCA0000.00000004.mdmp, 00000000-00004240.00000001.202497.EDCA0000.00000004.mdmp, 00000000-00004240.00000002.204415.EDCA0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Agent.exe" (Indicator: "\Device\"; Source: "00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp")53:Tfc2,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Agent.exe] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: Agent.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Agent.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Agent.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Agent.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: Agent.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Agent.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: Agent.exe] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: Agent.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: Agent.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: ISSetup.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: ISSetup.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ISSetup.dll] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: ISSetup.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ISSetup.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: ISSetup.dll] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: ISSetup.dll] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: ISSetup.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: setup.exe] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: setup.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: setup.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: setup.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: setup.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: setup.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: setup.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: setup.exe] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: setup.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: setup.exe]54:T1104,"{"serverRootCert":"-----BEGIN CERTIFICATE-----\r\nMIIDqzCCApOgAwIBAgIIKPFSPpma89swDQYJKoZIhvcNAQELBQAwZTELMAkGA1UE\r\nBhMCVVMxCzAJBgNVBAgMAkNBMRUwEwYDVQQLDAxNYW5hZ2VFbmdpbmUxGTAXBgNV\r\nBAoMEFpvaG8gQ29ycG9yYXRpb24xFzAVBgNVBAMMDk1hbmFnZUVuZ2luZUNBMCAX\r\nDTI2MDgwNTEzMDgxMFoYDzIxMjYwODA1MTMwODEwWjBlMQswCQYDVQQGEwJVUzEL\r\nMAkGA1UECAwCQ0ExFTATBgNVBAsMDE1hbmFnZUVuZ2luZTEZMBcGA1UECgwQWm9o\r\nbyBDb3Jwb3JhdGlvbjEXMBUGA1UEAwwOTWFuYWdlRW5naW5lQ0EwggEiMA0GCSqG\r\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAwW6eZ6RlUdZVcYPMOiqlWy+AGuSUowpj\r\nSeXoFQ+NzQIhrwa4OQT41XO7IncbzTTeWlK0Xxp+ZlTPkNd4inFLvKiGpjRQEyey\r\nYRAtSKuMIg98Mu85zcICkL6pJ4ALMGGtZE486V4OGhxvjVMaO3fDxOzFMkUkMC3r\r\nRRBFF0Ui8SOYZdFsl9InsfkyrvvLugIX9vaaiaix3w72fO5UYQoakNbjqrj\/+iPr\r\nxVeoj0R6e+\/fz2yiwZb6ceVJKfelhEupYraPyXqWQDqzE9CXZzBxPY2YD4vzheo+\r\ndr8IhTGblaS+81ftXbY0ViDwU2Ob4kaRmKW4CsrTLEv5JI\/NlZ2NAgMBAAGjXTBb\r\nMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFIyEzK\/PQ9pYfpkQdeyVfICmRYqqMB8G\r\nA1UdIwQYMBaAFIyEzK\/PQ9pYfpkQdeyVfICmRYqqMAsGA1UdDwQEAwIBpjANBgkq\r\nhkiG9w0BAQsFAAOCAQEABf7Pxvs0lWrrE+nuOb8D2WfH4dldz5KMsPA4mCbQxzAP\r\nPUECguK1uYWAD0MGSipCDgeDyAYD9WNkO1AtmdqbLJc\/\/iAQVe\/oHvKs2JATSa02\r\naCvNPQTpRYRmR8pm1SLcQWUuySyRdhxrXDcLjkp44Y99OUiGH8\/NbojTOBL6RTy0\r\nau4t77yqf6jBA1jXw0dZKxA9AbcdlZQfYXtr\/oOxL0nfiYC9lyI3OkshBh7N7RzW\r\n6Z9vnfnxDuYGRCES2gDDvuJYMgYftrPSvlXP+TKfG9J8sUo\/XoJHsBrFplAOdeqP\r\n7cfIEskGaNVJdslp4nl8PSbjb9TCJzwLwo0qD6p0mw==\r\n-----END CERTIFICATE-----\r\n","RemoteOfficeProps":{"SERVERPROTOCOL":"https","REMOTEOFFICENAME":"Local Office","CUSTOMERID":"1","ENABLEPROXY":"no","REMOTEOFFICEAUTHKEY":"bcbc91e6d5d869bd3c91ac143e74f5d0","USEJSON":"true","CUSTOMERNAME":"DC_CUSTOMER","MSIRESTARTMANAGERCONTROL":"Disable","REMOTEOFFICEID":"1","ALLUSERS":"1"},"DSAuthProps":{"branchID":"1","VALUE1":"78c8f285fb57f50f10e92340a7402c5ea11e4c9ff36211242547e7f158e8296e25653206ba16b5de0788e61b00a8850f","SC_VALUE":"0","VALUE2":"bcbc91e6d5d869bd3c91ac143e74f5d0"},"ServerInfoProps":{"SERVERFLATNAME":"WIN-3IP1UP2KDBG","productcode":"DCEE","SERVERSECIPADDRESS":"137.220.224.43","SERVERPORT":"8383","SERVERIPADDRESS":"137.220.224.43","MSPNAME":"DC_MSP","SERVERSECUREPORT":"8383","SERVERNAME":"WIN-3IP1UP2KDBG"},"AgentProps":{"PERFORMASSETSCAN":"yes","AGENTVERSION":"11.3.2400.33.W","AGENTPOLLINGINTERVAL":"2","PERFORMPOSTINSTALL":"yes","DATA_TRANSFER_RATE":"0","UNIQUE_ID_PARAM":"SERVICE_TAG","UNIQUE_ID_STATUS":"false","PERFORMPATCHSCAN":"no","ProductVersion":"11.3.2400.33.W","USEJSON":"true","PROXYBYPASS":"","ENABLE_CAPTCHA":"yes","ENABLESILENT":"YES","ENABLEREMOTEOFFICEMGMT":"no","UEMSProductCode":"[DCEE]","ENABLEDISTRIBUTIONSERVER":"no","AUTODETECT_PROXY":"false"},"sc_value":0,"ServerHashTime":"1785936115","customerRootCert":"-----BEGIN CERTIFICATE-----\r\nMIIEJTCCAw2gAwIBAgIICmQTv7l1KqYwDQYJKoZIhvcNAQELBQAwgaExCzAJBgNV\r\nBAYTAlVTMQswCQYDVQQIDAJDQTEVMBMGA1UECwwMTWFuYWdlRW5naW5lMRkwFwYD\r\nVQQKDBBab2hvIENvcnBvcmF0aW9uMRcwFQYDVQQDDA5NYW5hZ2VFbmdpbmVDQTEd\r\nMBsGA1UEAwwUTWFuYWdlRW5naW5lQ0EtRFMtQ0ExGzAZBgNVBAsMEk1hbmFnZUVu\r\nZ2luZS1EUy1DQTAgFw0yNjA4MDUxMzIxNTdaGA8yMTI2MDgwNTEzMjE1N1owgaEx\r\nCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEVMBMGA1UECwwMTWFuYWdlRW5naW5l\r\nMRkwFwYDVQQKDBBab2hvIENvcnBvcmF0aW9uMRcwFQYDVQQDDA5NYW5hZ2VFbmdp\r\nbmVDQTEdMBsGA1UEAwwUTWFuYWdlRW5naW5lQ0EtRFMtQ0ExGzAZBgNVBAsMEk1h\r\nbmFnZUVuZ2luZS1EUy1DQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\r\nAJGRw35WYWd99JV\/Ux4bbcLR1Dj84ch+L\/XfVvFqjJZhEcMTbo++vtxCUpWqVcPm\r\n6Jb7mT4y0meYZ+yFRwyLBt0wzCWJBzNVcPEx2Lz73qiR37DHyNM0XylFcDJ5PXbw\r\neCRsUOPJrqYDVq40GOGUWJiRt80snjp\/eGvWtjnavna\/yqh5HDTfq5JDG3baX326\r\nrdQ\/4MsCGPC88al3cqKyaO5vXpMlB3fx1nMV95ku2kOslv8qj97qIG2PIrzXuUb2\r\nuNxLAHWaNkZ+POOFx5kyxpXuAnYajWnXhaxgFO\/GsAOgknMtH5r1wHbN4JGeQnL0\r\nl5O8IPf5vg1uOsAoTo9ukCMCAwEAAaNdMFswDAYDVR0TBAUwAwEB\/zAdBgNVHQ4E\r\nFgQUeE3DIeu7UeHYX3WFTUSjermOCLEwHwYDVR0jBBgwFoAUeE3DIeu7UeHYX3WF\r\nTUSjermOCLEwCwYDVR0PBAQDAgGmMA0GCSqGSIb3DQEBCwUAA4IBAQCIncZmYyiO\r\nmHDZKLJBE+M9KsZnuTRoQZ0GEVoKEIAmRt62WuNncYZ0ZXZVqL1PeJGejTWXtAYs\r\naUIjutG6jQod2EzJniJ+BqF+m\/d1v\/P+p4YykoXG9s9SiMtRCtD6BV16\/zKtGrNN\r\nhziYPlrmFOda4v++\/gRsA3d6dL1ggw3ZN7s3krVykdYUEnOMFy9RvO7Vp74a6uLh\r\npUDWW24SrOiic1A\/84o5nyLivUXWHcaZQ6Wd3x6fLotCRkGpq52ha07qcqvL1541\r\nLo9O86HEry3G7hDViyqS6VIIcMXWbf7Ab3DDUTmb7fIPAPYtlS4PCbLCo7b4pSWJ\r\nu3RHKkG7i9fq\r\n-----END CERTIFICATE-----\r\n"}" (Indicator: "----begin certificate----") in Source: DCAgentServerInfo.json55:T4b0,"Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\AGENT.EXE"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.EXE"; Value: "") "Agent.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\TEMP\AGENTINSTALLERCOMPONENT.EXE"; Value: "")56:T76a,"ISSetup.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\ISSetup.dll]- [targetUID: 00000000-00002316] "setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.exe]- [targetUID: 00000000-00002316] "_isAA81.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA81.tmp]- [targetUID: 00000000-00004960] "_isAA51.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA51.tmp]- [targetUID: 00000000-00004960] "isrAA01.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 PECompact2 compressed 3 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrAA01.tmp]- [targetUID: 00000000-00004960] "ISBA9DF.tmp" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp]- [targetUID: 00000000-00004960] "dotA9CE.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp]- [targetUID: 00000000-00004960] "ISSetup.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\ISSetup.dll]- [targetUID: 00000000-00002316] "Agent.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Agent.exe]- [targetUID: 00000000-00002316]57:T916,Found string "DllGetClassObject" (Source: Agent.exe, API is part of module: UXTHEME.DLL) Found string "SetDllDirectoryW" (Source: Agent.exe, API is part of module: KERNEL32.DLL) Found string "SetSearchPathMode" (Source: Agent.exe, API is part of module: KERNEL32.DLL) Found string "GetSystemWindowsDirectoryW" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "RegCreateKeyTransactedW" (Source: Agent.exe, API is part of module: ADVAPI32.DLL) Found string "SetDefaultDllDirectories" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "RegDeleteKeyTransactedW" (Source: Agent.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyExW" (Source: Agent.exe, API is part of module: ADVAPI32.DLL) Found string "Wow64EnableWow64FsRedirection" (Source: Agent.exe, API is part of module: KERNEL32.DLL) Found string "Wow64DisableWow64FsRedirection" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "Wow64RevertWow64FsRedirection" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "IsWow64Process" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcessId" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "Process32First" (Source: Agent.exe, API is part of module: KERNEL32.DLL) Found string "Process32Next" (Source: Agent.exe, API is part of module: KERNEL32.DLL) Found string "NtQueryInformationProcess" (Source: Agent.exe, API is part of module: NTDLL.DLL) Found string "FindFirstFileA" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "CreateDirectoryA" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: Agent.exe, API is part of module: KERNELBASE.DLL) Found string "CreateSemaphoreExW" (Source: Agent.exe, API is part of module: KERNELBASE.DLL)58:T80f,"ISSetup.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\ISSetup.dll]- [targetUID: 00000000-00002316] "setup.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.exe]- [targetUID: 00000000-00002316] "_isAA81.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA81.tmp]- [targetUID: 00000000-00004960] "_isAA51.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 2 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA51.tmp]- [targetUID: 00000000-00004960] "isrAA01.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 PECompact2 compressed 3 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrAA01.tmp]- [targetUID: 00000000-00004960] "ageC0F8.tmp" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%WINDIR%\Temp\ageC0F8.tmp]- [targetUID: 00000000-00004960] "ISBA9DF.tmp" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp]- [targetUID: 00000000-00004960] "dotA9CE.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp]- [targetUID: 00000000-00004960] "ISSetup.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\ISSetup.dll]- [targetUID: 00000000-00002316] "Agent.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Agent.exe]- [targetUID: 00000000-00002316]59:T10d9,"Agent.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\ISSetup.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Agent.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\ISSetup.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 23768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 32766 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 32766 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrAA01.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 32766 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA51.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 32766 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA81.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Agent.exe" wrote 32766 bytes starting with PE header signature to file "C:\Windows\Temp\ageC0F8.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5a:T8aa,"Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\A8BE.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setA95B.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\InsA99B.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FonA9AC.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFA9AD.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\corA9BD.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9DE.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\StrAA00.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\isrAA01.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\defAA40.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA51.tmp" for deletion "Agent.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\_isAA81.tmp" for deletion "Agent.exe" marked "C:\Windows\Temp\ageC0F8.tmp" for deletion "Agent.exe" marked "C:\Windows\Temp\UEMC195.tmp" for deletion "Agent.exe" marked "C:\Windows\Temp\UEMCEA6.tmp" for deletion5b:Ta3a,"Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\Disk1\setup.exe" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\A8BE.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\setA95B.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\SETUP.INX" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\InsA99B.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\INSTALL.BAT" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FonA9AC.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\FONTDATA.INI" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFA9AD.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\DIFXDATA.INI" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\corA9BD.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\CORECOMP.INI" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9CE.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\DOTNETINSTALLER.EXE" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\dotA9DE.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\DOTNETINSTALLER.EXE.CONFIG" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBA9DF.tmp" with delete access "Agent.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.EXE" with delete access5c:T4a5,RegOpenKeyExW RegDeleteValueW SetSecurityDescriptorDacl RegCloseKey OpenProcessToken RegCreateKeyExW RegDeleteKeyW RegOpenKeyW RegEnumKeyW RegEnumKeyExW LockResource IsDebuggerPresent LoadLibraryExW FindFirstFileW GetSystemDirectoryA GetTempPathW OpenProcess GetTickCount LoadLibraryA CreateDirectoryW GetTempFileNameW WriteProcessMemory FindResourceExW DeleteFileW GetSystemInfo MapViewOfFile FindNextFileW LoadLibraryW WriteFile GetModuleHandleW CreateThread ExitThread GetSystemDirectoryW Sleep GetFileSize GetModuleHandleExW GetProcAddress CreateFileMappingW UnhandledExceptionFilter CreateFileW GetFileAttributesW OutputDebugStringW GetVersionExW CopyFileW CreateProcessW LoadLibraryExA GetModuleFileNameW VirtualProtectEx FindResourceW TerminateProcess GetThreadContext GetStartupInfoW GetCommandLineW ShellExecuteExW FindWindowExW GetCommandLineA GetModuleFileNameA CreateFileA VirtualAlloc WinExec OutputDebugStringA GetVersionExA GetModuleHandleA GetStartupInfoA RegOpenKeyExA GetFileAttributesA Process32NextW CreateProcessA Process32FirstW CreateToolhelp32Snapshot GetNativeSystemInfo CopyFileA DeleteFileA5d:T8c0,"Agent.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 952) "Agent.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 952) "Agent.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1060) "Agent.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1060) "Agent.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1032) "Agent.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1032) "Agent.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1076) "Agent.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1076) "Agent.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1080) "Agent.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1080) "Agent.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1104) "Agent.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\{531BD515-73EA-42C0-8E91-C3796763B007}\ISBEW64.exe" (Handle: 1104) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\Temp\agentInstallerComponent.exe" (Handle: 448) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\Temp\agentInstallerComponent.exe" (Handle: 448) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\Temp\agentInstallerComponent.exe" (Handle: 448)5e:T64b,Spawned process "Agent.exe" (UID: 00000000-00002316) Spawned process "Agent.exe" with commandline "-package:"C:\\Agent.exe" -no_selfdeleter -IS_temp -media_path:"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\" -tempdisk1folder:"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\" -IS_OriginalLauncher:"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\Agent.exe"" (UID: 00000000-00004960) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B5716001-2C7F-484B-8EE8-DF81CEDBF40D}" (UID: 00000000-00005772) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA68DDAF-F450-428D-B77C-F9FBE38158EC}" (UID: 00000000-00003456) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81E16544-A719-4A97-B44E-2C77BEAEA024}" (UID: 00000000-00005016) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9C148AA-93A7-48D2-97C2-52463F26CA7F}" (UID: 00000000-00003428) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D20B644D-6DE2-4732-90AB-83E73A4310CE}" (UID: 00000000-00003716) Spawned process "ISBEW64.exe" with commandline "{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0037F871-8682-4248-A4B8-DA53A28E4B51}" (UID: 00000000-00004240) Spawned process "cmd.exe" with commandline "/C %WINDIR%\\Temp\\agentInstallerComponent.exe "C:\\Agent.exe" 3 > %WINDIR%\\Temp\\DesktopCentralAgent.txt 2>&1" (UID: 00000000-00005228) Spawned process "agentInstallerComponent.exe" with commandline ""C:\\Agent.exe" 3" (UID: 00000000-00006632)5f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiIiIiIiIiIiIiIiIdmZmZmZmZmZmZmZmZmZniGZmZmZmZmZmZmZmZmZmZohmZmZmZmZmZmZmZmZmZmaIZmZmZmZmZmZmZmZmZmZmiGZmZmZmZmZmZmZmZmZmZohmZmZmZmZmZmZmZmZmZmaIZmZmZmZmZmZmZmZmZmZmiGZmZmZmZ4//////h2ZmZohmZmZmeP/////////4ZmaIZmZmf////////////4ZmiGZmaP/////////////3ZohmZv///////4iP////+GaIZmj////4hmZmZmf///hmiGZ////4ZmZmZmZmaP/2Zohmj//4ZmZmZmZmZmb/hmaIZo//hmZmZmZmdmZm+GZmiGaP/2ZmZmZ4j/ZmZ4ZmZohmaPhmZnj///+GZmZmZmaIZmaPZmiP////dmZmZmZmiGZmZnZmZo///2ZmZmZmZohmZmZmZmZm//9mZmZmZmaIZmZmZmZ4hm/4ZmZmZmZmiGZmZnj//4Zo92ZmZmZmZohmZmZnj/92ZvZmZmZmZmaIZmZmZmf/ZmaGZmZmZmZmiGZmZmZmiGZmZmZmZmZmZohmZmZmZmhmZmZmZmZmZmaIZmZmZmZmZmZmZmZmZmZmiGZmZmZmZmZmZmZmZmZmZoh2ZmZmZmZmZmZmZmZmZmeIiIiIiIiIiIiIiIiIiIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790707624517,"unified_at":"2026-09-29T18:47:04.517Z","metadata":{"hashes":{"sha256":"4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","sha1":"3d40dc5eec31c87418de2c963d9ba8e07d55aa63","md5":"7bb2b32739152e9a8768e1da2844b0bb","sha512":"bcde492b78070c4e456871749d8d5b798926c740ca35e82bc4c36742b37a785517ecd920bf165e7484220b36edbe1144f7d14ab2f362e2015ac5b1138faeb4f3","ssdeep":"786432:XqNhQrv6aD8Bv2Kvt3mVB+/stLVX5r6nIGoJXZQB2rR:XghQj668BvBV3mVBIsNFzGZoN","ssdeep_chunks":["786432:XqNhQrv","786432:qNhQrv6","786432:NhQrv6a","786432:hQrv6aD","786432:Qrv6aD8","786432:rv6aD8B","786432:v6aD8Bv","786432:6aD8Bv2","786432:aD8Bv2K","786432:D8Bv2Kv","786432:8Bv2Kvt","786432:Bv2Kvt3","786432:v2Kvt3m","786432:2Kvt3mV","786432:Kvt3mVB","786432:vt3mVB+","786432:t3mVB+/","786432:3mVB+/s","786432:mVB+/st","786432:VB+/stL","786432:B+/stLV","786432:+/stLVX","786432:/stLVX5","786432:stLVX5r","786432:tLVX5r6","786432:LVX5r6n","786432:VX5r6nI","786432:X5r6nIG","786432:5r6nIGo","786432:r6nIGoJ","786432:6nIGoJX","786432:nIGoJXZ","786432:IGoJXZQ","786432:GoJXZQB","786432:oJXZQB2","786432:JXZQB2r","786432:XZQB2rR","1572864:XqNhQrv","1572864:qNhQrv6","1572864:NhQrv6a","1572864:hQrv6aD","1572864:Qrv6aD8","1572864:rv6aD8B","1572864:v6aD8Bv","1572864:6aD8Bv2","1572864:aD8Bv2K","1572864:D8Bv2Kv","1572864:8Bv2Kvt","1572864:Bv2Kvt3","1572864:v2Kvt3m","1572864:2Kvt3mV","1572864:Kvt3mVB","1572864:vt3mVB+","1572864:t3mVB+/","1572864:3mVB+/s","1572864:mVB+/st","1572864:VB+/stL","1572864:B+/stLV","1572864:+/stLVX","1572864:/stLVX5","1572864:stLVX5r","1572864:tLVX5r6","1572864:LVX5r6n","1572864:VX5r6nI","1572864:X5r6nIG","1572864:5r6nIGo","1572864:r6nIGoJ","1572864:6nIGoJX","1572864:nIGoJXZ","1572864:IGoJXZQ","1572864:GoJXZQB","1572864:oJXZQB2","1572864:JXZQB2r","1572864:XZQB2rR","786432:XghQj66","786432:ghQj668","786432:hQj668B","786432:Qj668Bv","786432:j668BvB","786432:668BvBV","786432:68BvBV3","786432:8BvBV3m","786432:BvBV3mV","786432:vBV3mVB","786432:BV3mVBI","786432:V3mVBIs","786432:3mVBIsN","786432:mVBIsNF","786432:VBIsNFz","786432:BIsNFzG","786432:IsNFzGZ","786432:sNFzGZo","786432:NFzGZoN"],"imphash":"42669f99775f2f541a042cacf40fa06b","pehash":"1de154ebeab571b850a5008e4da335ef01f808a6"},"file_info":{"file_name":"Agent.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":37766096,"entropy":7.92,"compile_timestamp":"2018-09-20T10:18:20","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1787769347000,"last_seen":1787818694000,"last_multi_scan":1787818694000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":430687,"raw_size":431104},{"name":".rdata","virtual_address":"0x6b000","virtual_size":101068,"raw_size":101376},{"name":".data","virtual_address":"0x84000","virtual_size":18776,"raw_size":9216},{"name":".rsrc","virtual_address":"0x89000","virtual_size":301476,"raw_size":301568},{"name":".reloc","virtual_address":"0xd3000","virtual_size":98330,"raw_size":98816}],"section_names":[".text",".rdata",".data",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":92},"sandbox_signatures":{"informative_count":242,"suspicious_count":20,"malicious_count":3,"total":265},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABmRisk.GLYP-5036","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls APIs used for Remove Service"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Observed Microsoft Internet Information Services [IIS] related strings in binary/memory"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decompress and copy files (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to verify if file exist on disk"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Other Network Medium","attack_id":"T1011","attack_id_wiki":"https://attack.mitre.org/techniques/T1011","identifiers":[{"type":"informative","value":"Contains ability to open/close a dial up connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Uses Windows cryptography API for obfuscation"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature to detect manageengine_desktop_central RMM tool file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1219","id":"yara-557","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"ASeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), Found reference to API \"DeleterDeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$25","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyTransactedW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$26","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$27","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"sample.bin\"), Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"Could not launch prerequisite, last error: %d, ShellExecute: %d\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\CodeBases\\isdev\\redist\\Language Independent\\i386\\ISP\\setup.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyTransactedW\" in \"sample.bin\", Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\"), Found reference to API \"\tReturnValue=%ld\tGetLastError=0x%08lx\t\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionEx\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"sample.bin\"), Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformationW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\"), Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallShield Uninstall Information\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-140","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExW\" in \"sample.bin\", Found registry query API: \"RegQueryInfoKeyW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyTransactedW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$29","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Please enter the password\" (Indicator: \"password\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\"), Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\InstallShield Uninstall Information\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-82","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; Source: \"sample.bin\"), Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\"), Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-539","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open/close a dial up connection (API string)","description":"Found reference to API \"InternetAutodial\" (Indicator: \"InternetAutodial\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1011","id":"string-540","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.installshield.com/isetup/proerrorcentral.asp?errorcode=%d\", Pattern match: \"http://www.manageengine.com\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-241","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-314","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\", \"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-537","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-538","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\"), Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"sample.bin\"), Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1021","id":"string-160","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"sample.bin\"), Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1574.007","id":"string-530","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to decompress and copy files (API string)","description":"Found reference to API \"LZCopy\" (Indicator: \"LZCopy\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-305","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"OPTYPE_PROGMAN\" (Program manager) in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1055.011","id":"string-4","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe \" (Indicator: \"explorer.exe\"; Source: \"sample.bin\"), Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"unknown compression method\" (Source: \"00000000-00004960.00000000.200160.7304E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (File: \"Agent.exe\")\n Found string \"DeleteService\" (Source: \"00000000-00004960.00000000.200160.7304E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"Agent.exe\" called \"FindResourceW\" with parameter \"107\" - (UID: 00000000-00004960)\n \"Agent.exe\" called \"FindResourceW\" with parameter \"109\" - (UID: 00000000-00004960)\n \"Agent.exe\" called \"FindResourceW\" with parameter \"10303\" - (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Agent.exe\" called \"LoadResource with parameter {'hModule': '16580608', 'hResInfo': '17144416'}\" (UID: 00000000-00004960)\n \"Agent.exe\" called \"LoadResource with parameter {'hModule': '16580608', 'hResInfo': '17144448'}\" (UID: 00000000-00004960)\n \"Agent.exe\" called \"LoadResource with parameter {'hModule': '125304832', 'hResInfo': '125529568'}\" (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Agent.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\{820C1605-1AA7-4AF9-9AF2-3195A684D7FA} (UID: 00000000-00004960)\n \"Agent.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\{0F956378-5E94-4187-8A48-554B92CB51C9} (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"Agent.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.LoadFrom\" in \"dotA9CE.tmp\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Agent.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Agent.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"agentInstallerComponent.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"Agent.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\")\n \"Agent.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2c","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Agent.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004960-16475-29-01012943\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004960-16475-1815-01012920","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"$2d","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"Agent.exe\")\n Found reference to API \"CertGetNameStringA\" (Indicator: \"CertGetNameString\"; File: \"Agent.exe\")\n Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"Agent.exe\")\n Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"Agent.exe\")\n Found reference to API \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; File: \"Agent.exe\")\n Found reference to API \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; File: \"Agent.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Uses Windows cryptography API for obfuscation\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"ageC0F8.tmp\")\n Found string \"nOSVersionInfoSize\" (Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000000.200160.058D0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.058D0000.00000004.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.07A9F000.00000004.mdmp\")\n Found string \"lpMachineName\" (Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.07A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"Agent.exe\")\n Found string \"QueryServiceStatusEx\" (Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00004960.00000000.200160.7304E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Agent.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Agent.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002316)\n \"Agent.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004960)\n \"Agent.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Agent.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002316)\n \"Agent.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Agent.exe\" called \"IsWow64Process\" with parameter \"2316\" - (UID: 00000000-00002316)\n \"Agent.exe\" called \"IsWow64Process\" with parameter \"4960\" - (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$34","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Agent.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002316)\n \"Agent.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Agent.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000000000680b5e000000000040d88f0059167c770100000008000000010000000000ab00951e5b2a10000000000000000000000002000000020000000000ab0001000000080000000000000060d88f00ee137c7701000000ee137c7708000000000000000800000075ea445998da8f00ad9cb3720000ab000800000001000000 (UID: 00000000-00004960)\n \"Agent.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000b000000f861b00007000b0020135e00640000000000000000d88f00400800000000000000000000e4d78f005744ad9fecd68f0000000000a8d88f00506a7f773f7da5e8fefffffff9de7a77a599d97402100000000000000000000000100000000000000000000060d88f0028d88f00f9de7a77 (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"Agent.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00004960)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Agent.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ISSetup.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: setup.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-345-0102BC70\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-385-01028B40\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-637-0100B227\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-866-00FDE9AA\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-873-00FE0B9C\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-874-00FE0C39\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-918-00FE0EE8\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-1207-00FE76E6\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-1218-00FE0F50\n GetTickCount@KERNEL32.DLL at 00000000-00004960-16475-1676-00FFE261","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00004960-16475-620-010044D0\n FindFirstFileW@KERNEL32.DLL at 00000000-00004960-16475-1570-00FF00B5\n FindFirstFileW@KERNEL32.DLL at 00000000-00004960-16475-1642-00FF5708\n FindNextFileW@KERNEL32.DLL at 00000000-00004960-16475-3212-0100BCC2\n FindFirstFileW@KERNEL32.DLL at 00000000-00004960-16475-3213-0100BC39","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004960-16475-1022-00FEE3A4\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00004960-16475-1648-00FF7820\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004960-16475-1875-010186DB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004960-16475-1022-00FEE3A4\n GetLocalTime@KERNEL32.DLL at 00000000-00004960-16475-1598-01001476\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004960-16475-1875-010186DB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1077-00FE8C23\n GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1186-00FD85AC\n GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1189-010056CF\n GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1190-0100570F\n GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1192-01005443\n GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1266-01004B32\n GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1291-00FF8D6A\n GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1309-00FDED99\n GetVersion@KERNEL32.DLL at 00000000-00004960-16475-1460-0100B848\n GetVersionExW@KERNEL32.DLL at 00000000-00004960-16475-1461-01005751\n GetVersion@KERNEL32.DLL at 00000000-00004960-16475-1600-01000B63","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00004960-16475-880-00FDF17F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00004960-16475-1057-00FEAC54","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Agent.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Agent.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"ISBEW64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"agentInstallerComponent.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00004960-16475-1051-00FE5777\n GetSystemInfo@KERNEL32.DLL at 00000000-00004960-16475-1066-00FE82FB\n GetSystemInfo@KERNEL32.DLL at 00000000-00004960-16475-1227-01006AD6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Agent.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultLangID@KERNEL32.DLL at 00000000-00004960-16475-1029-00FE4FC6\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00004960-16475-1031-01004F5C\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00004960-16475-2898-00FFC584","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformation\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00004960-16475-1264-010064C6\n GetProcessHeap@KERNEL32.DLL at 00000000-00004960-16475-1377-00FF8E1C\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004960-16475-1458-0100B6DD\n OpenProcess@KERNEL32.DLL at 00000000-00004960-16475-1528-0100698F\n OpenProcess@KERNEL32.DLL at 00000000-00004960-16475-1543-01004B97\n OpenProcess@KERNEL32.DLL at 00000000-00004960-16475-1546-010062DF\n GetProcessHeap@KERNEL32.DLL at 00000000-00004960-16475-3340-01011BA0\n GetProcessHeap@KERNEL32.DLL at 00000000-00004960-16475-3352-01017B06","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"PathFileExistsW@SHLWAPI.DLL at 00000000-00004960-16475-613-00FD6C97","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetDiskFreeSpaceExW@KERNEL32.DLL directly followed by \"cmp word ptr [ebp-0000020Ch], di\" and \"push ecx\" at 00000000-00004960-16475-1057-00FEAC54\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000108h], 01h\" and \"jne 010054D5h\" at 00000000-00004960-16475-1192-01005443\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ecx, eax\" and \"ret\" at 00000000-00004960-16475-1460-0100B848\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 80000000h\" and \"jbe 01000F5Ah\" at 00000000-00004960-16475-1600-01000B63","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\ISSETUP.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"cmd.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00005228-00000C17-2135421411","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Agent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ISBEW64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"agentInstallerComponent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$36","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"Agent.exe\")\n Found reference to API \"EnumDependentServicesW\" (Indicator: \"EnumDependentServices\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004960.00000000.200160.7304E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"ISBA9DF.tmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002316.00000001.202025.0097B000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004240.00000001.202497.5ED67000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp, 00000000-00004960.00000002.203999.077B3000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$37","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select the language for the installation from the choices below.\" (Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, Indicator: \"select the language for the installation from the choices below.\")\n \"Select the language for this installation from the choices below.\" (Source: 00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, Indicator: \"select the language for this installation from the choices below.\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000000.200160.7304E000.00000002.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00004960-16475-44-01016C22\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-49-01016BD8\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-58-01016C6B\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004960-16475-812-00FDCAF1\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-875-00FDD260\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-918-00FE0EE8\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-1144-00FD6941\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-1170-00FEBCEA\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-1241-00FED6D0\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004960-16475-1258-00FDD57A\n MsgWaitForMultipleObjects at 00000000-00004960-16475-1311-00FF62A8\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004960-16475-1529-01006A5C\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-1575-00FEF374\n MsgWaitForMultipleObjects at 00000000-00004960-16475-1759-0100A910\n Sleep@KERNEL32.DLL at 00000000-00004960-16475-1835-01016CB7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Agent.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: ISSetup.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: setup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: _isAA81.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: isrAA01.tmp)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00004960-16475-31-0101B245\n LoadLibraryW@KERNEL32.DLL at 00000000-00004960-16475-226-0102D660\n LoadLibraryW@KERNEL32.DLL at 00000000-00004960-16475-277-0102A0D0\n LoadLibraryW@KERNEL32.DLL at 00000000-00004960-16475-505-010200C0\n LoadLibraryA@KERNEL32.DLL at 00000000-00004960-16475-684-00FD83E3\n LoadLibraryW@KERNEL32.DLL at 00000000-00004960-16475-1074-00FE81B1\n LoadLibraryExW@KERNEL32.DLL at 00000000-00004960-16475-1098-00FEB46E\n LoadLibraryExA@KERNEL32.DLL at 00000000-00004960-16475-1693-010008BA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"nStartServiceWaitCount\" (Indicator: \"StartService\"; Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.07A9F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3c","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: Agent.exe)\n Found MoveFileW in import section (Source: ISSetup.dll)\n Found MoveFileW in import section (Source: setup.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$3f","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Agent.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"ISSetup.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"setup.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"ageC0F8.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"ISBA9DF.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"dotA9CE.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$40","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Agent.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 72B50000\n \"Agent.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72AD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Agent.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75500000\n \"ISBEW64.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 41E00000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75500000\n \"agentInstallerComponent.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75500000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Agent.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74A70000\n \"ISBEW64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 44730000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74A70000\n \"agentInstallerComponent.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74A70000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a007400000040c74041ff7f0000@ntdll.dll\"\n \"\"#t@ntdll.dll\", \"19001a00c000000040c74041ff7f0000@ntdll.dll\", \"22002300c000000018c74041ff7f0000@ntdll.dll\", \"19001a009200000040c74041ff7f0000@ntdll.dll\", \"220023009200000018c74041ff7f0000@ntdll.dll\", \"19001a00fb00000040c74041ff7f0000@ntdll.dll\", \"22002300fb00000018c74041ff7f0000@ntdll.dll\", \"19001a009c00000040c74041ff7f0000@ntdll.dll\", \"220023009c00000018c74041ff7f0000@ntdll.dll\", \"19001a002200000040c74041ff7f0000@ntdll.dll\", \"\"#\"@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Agent.exe\" touched \"PSDispatch\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00020420-0000-0000-C000-000000000046}\")\n \"Agent.exe\" touched \"PSTypeInfo\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00020422-0000-0000-C000-000000000046}\\TREATAS\")\n \"Agent.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")\n \"ISBEW64.exe\" touched \"ItemMoniker\" (Path: \"HKCU\\CLSID\\{00000304-0000-0000-C000-000000000046}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"dotA9CE.tmp\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Agent.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ISSetup.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"setup.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"_isAA81.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"isrAA01.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ageC0F8.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ISBA9DF.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Agent.exe\" has an executable section named \".text\"\n \"ISSetup.dll\" has an executable section named \".text\"\n \"ISSetup.dll\" has an executable section named \".orpc\"\n \"setup.exe\" has an executable section named \".text\"\n \"_isAA81.tmp\" has an executable section named \".text\"\n \"isrAA01.tmp\" has an executable section named \".text\"\n \"isrAA01.tmp\" has an executable section named \".rsrc\"\n \"ageC0F8.tmp\" has an executable section named \".text\"\n \"ISBA9DF.tmp\" has an executable section named \".text\"\n \"dotA9CE.tmp\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Agent.exe\" has an writable section named \".data\"\n \"ISSetup.dll\" has an writable section named \".data\"\n \"setup.exe\" has an writable section named \".data\"\n \"_isAA81.tmp\" has an writable section named \".data\"\n \"_isAA81.tmp\" has an writable section named \".idata\"\n \"isrAA01.tmp\" has an writable section named \".text\"\n \"isrAA01.tmp\" has an writable section named \".rsrc\"\n \"isrAA01.tmp\" has an writable section named \".reloc\"\n \"ageC0F8.tmp\" has an writable section named \".data\"\n \"ISBA9DF.tmp\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$43","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rsrc\" is \"0x18f000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rsrc\" is \"0x18e339\" greater than 0x100000\n Virtual size of \".text\" is \"0x10e000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"ISBA9DF.tmp\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Temp\\agentInstallerComponent.exe\" [Source: 00000000-00004960-00000C57-2131320921]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe /C %WINDIR%\\Temp\\agentInstallerComponent.exe \"C:\\Agent.exe\" 3 > %WINDIR%\\Temp\\DesktopCentralAgent.txt 2>&1\" [Source: 00000000-00004960-00000C46-24829427542]\n Observed system executable string:\"%WINDIR%\\Temp\\agentInstallerComponent.exe \"C:\\Agent.exe\" 3\" [Source: 00000000-00005228-00000C47-855766346]\n Observed system executable string:\"/C %WINDIR%\\Temp\\agentInstallerComponent.exe \"C:\\Agent.exe\" 3 > %WINDIR%\\Temp\\DesktopCentralAgent.txt 2>&1\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Agent.exe\" (UID: 00000000-00004960) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Agent.exe\" (UID: 00000000-00004960) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"agentInstallerComponent.exe\" (UID: 00000000-00006632) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$44","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\VERSION.dll\" [Source: 00000000-00004960-00000C2B-2125038039]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00004960-00000C2B-2125796838]\n Observed system executable string:\"%WINDIR%\\system32\\RICHED32.DLL\" [Source: 00000000-00004960-00000C2B-2125849784]\n Observed system executable string:\"%WINDIR%\\system32\\AppHelp.dll\" [Source: 00000000-00004960-00000C2B-2129573691]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Agent.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$46","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 0B:BF:AB:97:05:95:95:E8:D1:EC:48:E8:9E:B8:65:7C:0E:5A:AE:71; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3\" (SHA1: 4C:5D:80:D2:CD:06:B1:A4:93:C4:9B:2E:9B:ED:4A:57:C2:F8:73:E5; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Code Signing Root R45, O=GlobalSign nv-sa, C=BE\" (SHA1: 7A:21:46:ED:B2:9E:2E:AD:64:AF:BE:7C:EA:D0:B6:08:5D:43:7A:32; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE\" (SHA1: C7:08:30:D1:7A:BB:71:19:FC:E1:A1:DD:2D:C9:FD:0E:92:E3:32:41; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Agent.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ISSetup.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"setup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"_isAA81.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"_isAA51.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"isrAA01.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ageC0F8.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"dotA9CE.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Agent.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\0x0409.ini\"\n \"Agent.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\data1.cab\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Agent.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$48","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"ISSetup.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections\"- Location: [%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\ISSetup.dll]- [targetUID: 00000000-00002316]\n \"ISSetup.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections\"- Location: [%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\ISSetup.dll]- [targetUID: 00000000-00002316]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Agent.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Agent.exe\" (UID: 4960)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Agent.exe\" reads file \"c:\\agent.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4b","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Agent.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Agent.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"Agent.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Agent.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"Agent.exe\" trying to touch file \"C:\\Agent.exe\"\n \"Agent.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Agent.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Agent.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Agent.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Agent.exe\" trying to touch file \"C:\\AGENT.EXE.LOCAL\"\n \"Agent.exe\" trying to touch file \"C:\\Agent.exe.Local\\\"\n \"Agent.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"\n \"Agent.exe\" trying to touch file \"C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\COMCTL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Agent.exe\" touched file \"C:\\Windows\\Temp\\DesktopCentralAgent_DC.txt\"\n \"Agent.exe\" touched file \"C:\\Windows\\Temp\\ageC0F8.tmp\"\n \"Agent.exe\" touched file \"C:\\Windows\\Temp\\UEMC195.tmp\"\n \"Agent.exe\" touched file \"C:\\Windows\\Temp\\UEMCEA6.tmp\"\n \"cmd.exe\" touched file \"C:\\Windows\\Temp\\DesktopCentralAgent.txt\"\n \"agentInstallerComponent.exe\" touched file \"C:\\Windows\\Temp\\DCAgentServerInfo.json\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Agent.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\{7f2a8b10-0140-436c-b079-a30e28bc39c1}\\disk1\\0x0409.ini\"\n \"Agent.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\{7f2a8b10-0140-436c-b079-a30e28bc39c1}\\disk1\\data1.cab\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCancelConnectionW\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")\n Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002316.00000000.200103.03200000.00000004.mdmp, 00000000-00002316.00000001.202025.03200000.00000004.mdmp, 00000000-00002316.00000002.203946.03200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"The length of an option supplied to InternetQueryOption or InternetSetOption is incorrect for the type of option specified.\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp\")\n Found reference to API \"A request to InternetQueryOption or InternetSetOption specified an invalid option value.\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00004960.00000000.200160.7304E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"dimap.dll\" [Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp\n 00000000-00004960.00000002.203999.05A60000.00000004.mdmp]\n Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp\n 00000000-00004960.00000002.203999.05A60000.00000004.mdmp]\n Observed email domain:\"ismsmtp.dll\" [Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp\n 00000000-00004960.00000002.203999.05A60000.00000004.mdmp]\n Observed email domain:\"midimap.dll\" [Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp\n 00000000-00004960.00000002.203999.05A60000.00000004.mdmp]\n Observed email domain:\"midimap.drv\" [Source: 00000000-00004960.00000001.202079.05A60000.00000004.mdmp\n 00000000-00004960.00000002.203999.05A60000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1: keep same verb\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$50","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Remote Access Related","name":"Observed Microsoft Internet Information Services [IIS] related strings in binary/memory","description":"Found string -C:\\inetpub\\wwwroot\\Indicator: \\inetpub\\wwwroot\\","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-130","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002316.00000000.200103.03200000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004240.00000000.200575.EDCA0000.00000004.mdmp, 00000000-00004240.00000001.202497.EDCA0000.00000004.mdmp, 00000000-00004240.00000002.204415.EDCA0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp\")\n Found string \"kerberos.dll\" (Indicator: \"kerberos\"; Source: \"00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"49868,1560,3024,,RtlGetVersion,NTDLL.dll,\"00:52:02.500\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002316.00000000.200103.03200000.00000004.mdmp, 00000000-00002316.00000001.202025.03200000.00000004.mdmp, 00000000-00002316.00000002.203946.03200000.00000004.mdmp\")\n Found reference to API \"50953,3868,3024,,RtlGetVersion,NTDLL.dll,\"00:52:06.156\"O\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp\")\n Found reference to API \"50953,3868,3024,,RtlGetVersion,NTDLL.dll,\"00:52:06.156\"\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ISSetup.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: _isAA81.tmp]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveType\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004960.00000000.200160.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.00AB0000.00000004.mdmp, 00000000-00004960.00000001.202079.05A60000.00000004.mdmp, 00000000-00004960.00000002.203999.00AB0000.00000004.mdmp, 00000000-00004960.00000002.203999.05A60000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Agent.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ISBEW64.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"agentInstallerComponent.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Agent.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"Agent.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00004240.00000001.202497.5ED67000.00000002.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"ISSetup.dll\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"Agent.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002316.00000000.200103.03200000.00000004.mdmp, 00000000-00002316.00000001.202025.03200000.00000004.mdmp, 00000000-00002316.00000002.203946.03200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: ISSetup.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Agent.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ISSetup.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: setup.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ageC0F8.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$52","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")\n Found reference to API \"_CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00004960.00000000.200160.10001000.00000040.mdmp, 00000000-00004960.00000001.202079.10001000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$53","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"$54","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"setA95B.tmp has high entropy\"\n \"setup.inx has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Agent.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"ISSetup.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"setup.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"_isAA81.tmp\" was detected as \"Microsoft Visual C++ v6.0 (Debug version)\"\n \"_isAA51.tmp\" was detected as \"Microsoft Visual C++ vx.x DLL\"\n \"isrAA01.tmp\" was detected as \"PeCompact 2.53 DLL --> BitSum Technologies\"\n \"ageC0F8.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"dotA9CE.tmp\" was detected as \"Microsoft Visual C# / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Agent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Agent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"agentInstallerComponent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"agentInstallerComponent.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"isrAA01.tmp\" has section name .text with entropy \"7.983803149208564\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%WINDIR%\\Temp\\UEMC195.tmp\" has high entropy 7.90485\n Dropped file \"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\data1.cab\" has high entropy 7.9966\n Dropped file \"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\isrAA01.tmp\" has high entropy 7.9727\n Dropped file \"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\setA95B.tmp\" has high entropy 7.37965\n Dropped file \"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\setup.inx\" has high entropy 7.37965","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses Windows cryptography API for obfuscation","description":"Observed Cryptography api used in \"advapi32.dll\" [Source: ISSetup.dll]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":3,"id":"static-207","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/24 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00004960-16475-182-0102D3A0\n FindResourceW@KERNEL32.DLL at 00000000-00004960-16475-227-0102D320\n FindResourceW@KERNEL32.DLL at 00000000-00004960-16475-680-00FD8013\n FindResourceExW@KERNEL32.DLL at 00000000-00004960-16475-820-01005F94\n LoadResource@KERNEL32.DLL at 00000000-00004960-16475-821-01005F20\n FindResourceW@KERNEL32.DLL at 00000000-00004960-16475-1098-00FEB46E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Agent.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\setup.ini\"\n \"Agent.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\setup.ini\"\n \"Agent.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\0x0409.ini\"\n \"Agent.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\0x0409.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$58","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$59","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00004960\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"isrAA01.tmp\"\n YARA signature for null IAT Directory of PE file \"_isAA51.tmp\"\n YARA signature for invalid Base of code of PE file \"_isAA81.tmp\"\n YARA signature for invalid Base of code of PE file \"_isAA51.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00004960-16475-1681-00FFEE12","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$5a","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$5b","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Agent.exe\" claimed CRC 37780895 while the actual is CRC 37809887\n \"_isAA51.tmp\" claimed CRC 1865925 while the actual is CRC 1075903\n \"ageC0F8.tmp\" claimed CRC 436069 while the actual is CRC 337453\n \"ISBA9DF.tmp\" claimed CRC 337453 while the actual is CRC 211797\n \"dotA9CE.tmp\" claimed CRC 211797 while the actual is CRC 87293","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00004960-16475-351-0102A060\n NtQueryInformationProcess@NTDLL.DLL at 00000000-00004960-16475-1546-010062DF\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00004960-16475-1687-010003D0\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00004960-16475-1905-01022DE0\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00004960-16475-1908-01029FE0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"isrAA01.tmp\" has an entrypoint in section \".rsrc\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$5c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections\" was dropped at \"%WINDIR%\\Temp\\ageC0F8.tmp\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$5d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$5e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]}],"intel_graph":{"map":{"File:01fecc0d057b0ef9869252a17cfb6f6680ffe3069a4f13f1ad37f2d6c3cfa202":{"type":"File","value":"01fecc0d057b0ef9869252a17cfb6f6680ffe3069a4f13f1ad37f2d6c3cfa202"},"File:0d3e03b70a4df0f53f237c113e5efe503f2c69f28cfe22cb0171b82abb8d5cae":{"type":"File","value":"0d3e03b70a4df0f53f237c113e5efe503f2c69f28cfe22cb0171b82abb8d5cae"},"File:13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301":{"type":"File","value":"13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301"},"File:23cabb1b4a802108b98d41c333c11cdb336f997776b2d3aa54367e8332028724":{"type":"File","value":"23cabb1b4a802108b98d41c333c11cdb336f997776b2d3aa54367e8332028724"},"File:35ab75740027bb7ea4682e26337219d136062b84040dae2dfc69c66463bc5eaa":{"type":"File","value":"35ab75740027bb7ea4682e26337219d136062b84040dae2dfc69c66463bc5eaa","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:379176a5ecde21f492dcc719250d47c368ae039eb9e549da8e300e6d69be6d72":{"type":"File","value":"379176a5ecde21f492dcc719250d47c368ae039eb9e549da8e300e6d69be6d72"},"File:37ebd6289b02d42dbcc1d83326c1f28c90d0eb93b80174c5eac48e6a9eb32bb8":{"type":"File","value":"37ebd6289b02d42dbcc1d83326c1f28c90d0eb93b80174c5eac48e6a9eb32bb8"},"File:3c3d7da255fb0241c53e030035b443c2fc1c3ae84109041fcc53347881b6c2bf":{"type":"File","value":"3c3d7da255fb0241c53e030035b443c2fc1c3ae84109041fcc53347881b6c2bf"},"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99":{"type":"File","value":"4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f":{"type":"File","value":"60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f"},"File:6bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1":{"type":"File","value":"6bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1"},"File:6ce6e1978e26b819e34c9aeffe346f1888aa59f0fcb9b21a32893504ca44fbd3":{"type":"File","value":"6ce6e1978e26b819e34c9aeffe346f1888aa59f0fcb9b21a32893504ca44fbd3","filetype":"data (from pem_certificate_decoder)","filetype_short":"DATA","mime_type":"application/x-x509-ca-cert"},"File:8075162db275eb52f5d691b15fc0d970cb007f5bece33ce5db509edf51c1f020":{"type":"File","value":"8075162db275eb52f5d691b15fc0d970cb007f5bece33ce5db509edf51c1f020"},"File:8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948":{"type":"File","value":"8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948"},"File:a79653e9f6c1cd1fee41316822b1954fc7ddc348218064d447f23be17cdfaeea":{"type":"File","value":"a79653e9f6c1cd1fee41316822b1954fc7ddc348218064d447f23be17cdfaeea"},"File:a7e91b042ce33490353c00244c0420c383a837e73e6006837a60d3c174102932":{"type":"File","value":"a7e91b042ce33490353c00244c0420c383a837e73e6006837a60d3c174102932"},"File:c7e5bdc4b79f7f8c68c5f09c0c055e97fb8c62fe1b5d469b3527ab6b767c8df2":{"type":"File","value":"c7e5bdc4b79f7f8c68c5f09c0c055e97fb8c62fe1b5d469b3527ab6b767c8df2"},"File:d643003634136509aaf18480a62057c04b16754c58caa03dd1375c1bc1e7dafa":{"type":"File","value":"d643003634136509aaf18480a62057c04b16754c58caa03dd1375c1bc1e7dafa"},"File:da52d33bfd437c1218f2aafc9f3b8d89dc48e88e3252882df92fee4542bf7e6b":{"type":"File","value":"da52d33bfd437c1218f2aafc9f3b8d89dc48e88e3252882df92fee4542bf7e6b"},"File:e9ba8c3f32eb58d9320fca9ed797b8fcdfb5d93ad000eb14d3cf5a68dca1e629":{"type":"File","value":"e9ba8c3f32eb58d9320fca9ed797b8fcdfb5d93ad000eb14d3cf5a68dca1e629"},"File:f0ccee56adebb0a79b5b7980ab9106f54f94f827963ad8998ea811e42422596a":{"type":"File","value":"f0ccee56adebb0a79b5b7980ab9106f54f94f827963ad8998ea811e42422596a"},"File:f6d7bc8ca6550662166f34407968c7d3669613e50e98a4e40bec1589e74ff5d1":{"type":"File","value":"f6d7bc8ca6550662166f34407968c7d3669613e50e98a4e40bec1589e74ff5d1"}},"chains":[{"id":"1542443770000232450","root":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:35ab75740027bb7ea4682e26337219d136062b84040dae2dfc69c66463bc5eaa"}],"verdict":{"verdict":"unknown"}},{"id":"1542443769996038145","root":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:6ce6e1978e26b819e34c9aeffe346f1888aa59f0fcb9b21a32893504ca44fbd3"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","edges":[{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:6ce6e1978e26b819e34c9aeffe346f1888aa59f0fcb9b21a32893504ca44fbd3"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:35ab75740027bb7ea4682e26337219d136062b84040dae2dfc69c66463bc5eaa"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:379176a5ecde21f492dcc719250d47c368ae039eb9e549da8e300e6d69be6d72"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:37ebd6289b02d42dbcc1d83326c1f28c90d0eb93b80174c5eac48e6a9eb32bb8"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:da52d33bfd437c1218f2aafc9f3b8d89dc48e88e3252882df92fee4542bf7e6b"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:a79653e9f6c1cd1fee41316822b1954fc7ddc348218064d447f23be17cdfaeea"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:e9ba8c3f32eb58d9320fca9ed797b8fcdfb5d93ad000eb14d3cf5a68dca1e629"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:01fecc0d057b0ef9869252a17cfb6f6680ffe3069a4f13f1ad37f2d6c3cfa202"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:23cabb1b4a802108b98d41c333c11cdb336f997776b2d3aa54367e8332028724"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:f6d7bc8ca6550662166f34407968c7d3669613e50e98a4e40bec1589e74ff5d1"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:c7e5bdc4b79f7f8c68c5f09c0c055e97fb8c62fe1b5d469b3527ab6b767c8df2"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:6bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:a7e91b042ce33490353c00244c0420c383a837e73e6006837a60d3c174102932"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:0d3e03b70a4df0f53f237c113e5efe503f2c69f28cfe22cb0171b82abb8d5cae"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:3c3d7da255fb0241c53e030035b443c2fc1c3ae84109041fcc53347881b6c2bf"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:8075162db275eb52f5d691b15fc0d970cb007f5bece33ce5db509edf51c1f020"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:23cabb1b4a802108b98d41c333c11cdb336f997776b2d3aa54367e8332028724"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:f0ccee56adebb0a79b5b7980ab9106f54f94f827963ad8998ea811e42422596a"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:d643003634136509aaf18480a62057c04b16754c58caa03dd1375c1bc1e7dafa"},{"edge_kind":"extracted","from_key":"File:4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","to_key":"File:e9ba8c3f32eb58d9320fca9ed797b8fcdfb5d93ad000eb14d3cf5a68dca1e629"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":10,"spawned_processes_count":10,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":40,"imported_dlls_count":66,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":39,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6a8ff2c3eb78a7c103047b5b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"ABmRisk.GLYP","submit_name":"Agent.exe","analysis_start_time":"2026-08-27T08:18:16+00:00","indicators_count":{"informative":240,"suspicious":60,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}],"processes":[{"pid":2316,"ppid":0,"name":"Agent.exe","command_line":"","sha256":"4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99","normalized_path":"C:\\Agent.exe","uid":"00000000-00002316","icon":"$5f"},{"pid":4960,"ppid":2316,"name":"Agent.exe","command_line":"-package:\"C:\\Agent.exe\" -no_selfdeleter -IS_temp -media_path:\"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\\" -tempdisk1folder:\"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\\" -IS_OriginalLauncher:\"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\Agent.exe\"","sha256":"e9ba8c3f32eb58d9320fca9ed797b8fcdfb5d93ad000eb14d3cf5a68dca1e629","normalized_path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Agent.exe","parent_uid":"00000000-00002316","uid":"00000000-00004960"},{"pid":5772,"ppid":4960,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B5716001-2C7F-484B-8EE8-DF81CEDBF40D}","sha256":"13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301","normalized_path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\ISBEW64.exe","parent_uid":"00000000-00004960","uid":"00000000-00005772"},{"pid":3456,"ppid":4960,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FA68DDAF-F450-428D-B77C-F9FBE38158EC}","sha256":"13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301","normalized_path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\ISBEW64.exe","parent_uid":"00000000-00004960","uid":"00000000-00003456"},{"pid":5016,"ppid":4960,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81E16544-A719-4A97-B44E-2C77BEAEA024}","sha256":"13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301","normalized_path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\ISBEW64.exe","parent_uid":"00000000-00004960","uid":"00000000-00005016"},{"pid":3428,"ppid":4960,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9C148AA-93A7-48D2-97C2-52463F26CA7F}","sha256":"13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301","normalized_path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\ISBEW64.exe","parent_uid":"00000000-00004960","uid":"00000000-00003428"},{"pid":3716,"ppid":4960,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D20B644D-6DE2-4732-90AB-83E73A4310CE}","sha256":"13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301","normalized_path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\ISBEW64.exe","parent_uid":"00000000-00004960","uid":"00000000-00003716"},{"pid":4240,"ppid":4960,"name":"ISBEW64.exe","command_line":"{EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0037F871-8682-4248-A4B8-DA53A28E4B51}","sha256":"13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301","normalized_path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\ISBEW64.exe","parent_uid":"00000000-00004960","uid":"00000000-00004240"},{"pid":5228,"ppid":4960,"name":"cmd.exe","command_line":"/C %WINDIR%\\Temp\\agentInstallerComponent.exe \"C:\\Agent.exe\" 3 > %WINDIR%\\Temp\\DesktopCentralAgent.txt 2>&1","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004960","uid":"00000000-00005228"},{"pid":6632,"ppid":5228,"name":"agentInstallerComponent.exe","command_line":"\"C:\\Agent.exe\" 3","sha256":"d4ac05e76fc40da3a8c7600829a4f9305e8f1ce758224f29b00ce0b62a33d9f0","normalized_path":"%WINDIR%\\Temp\\agentInstallerComponent.exe","parent_uid":"00000000-00005228","uid":"00000000-00006632"}],"all_imported_dlls":["imm32.dll","fltLib.dll","clbcatq.dll","comctl32.dll","profapi.dll","dwmapi.dll","WinTypes.dll","version.dll","usp10.dll","wow64cpu.dll","CoreUIComponents.dll","ntdll.dll","ole32.dll","ntmarta.dll","ExplorerFrame.dll","msasn1.dll","wow64.dll","apphelp.dll","shell32.dll","kernel.appcore.dll","oleaut32.dll","msctf.dll","TextInputFramework.dll","sxs.dll","combase.dll","powrprof.dll","crypt32.dll","kernel32.dll","ws2_32.dll","gdi32full.dll","sspicli.dll","windows.storage.dll","shlwapi.dll","GdiPlus.dll","msvcp140.dll","comdlg32.dll","KernelBase.dll","win32u.dll","gdi32.dll","ucrtbase.dll","VxSSL64.dll","cryptsp.dll","CoreMessaging.dll","vcruntime140.dll","isrt.dll","vcruntime140_1.dll","sechost.dll","cryptbase.dll","VxSSL32.dll","coml2.dll","_isres_0x0409.dll","_isuser_0x0409.dll","advapi32.dll","bcryptprimitives.dll","msvcrt.dll","user32.dll","rpcrt4.dll","SHCore.dll","ISSetup.dll","riched32.dll","msls31.dll","wow64win.dll","cfgmgr32.dll","uxtheme.dll","riched20.dll","msvcp_win.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"6ce6e1978e26b819e34c9aeffe346f1888aa59f0fcb9b21a32893504ca44fbd3","sha256":"6ce6e1978e26b819e34c9aeffe346f1888aa59f0fcb9b21a32893504ca44fbd3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"35ab75740027bb7ea4682e26337219d136062b84040dae2dfc69c66463bc5eaa","sha256":"35ab75740027bb7ea4682e26337219d136062b84040dae2dfc69c66463bc5eaa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"isrAA01.tmp","sha256":"379176a5ecde21f492dcc719250d47c368ae039eb9e549da8e300e6d69be6d72","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"ISBA9DF.tmp","sha256":"13097ee83046bc4066b4819f8881fefe3dcebf503a519373d449a664074d9301","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"dotA9CE.tmp","sha256":"37ebd6289b02d42dbcc1d83326c1f28c90d0eb93b80174c5eac48e6a9eb32bb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"_isAA51.tmp","sha256":"da52d33bfd437c1218f2aafc9f3b8d89dc48e88e3252882df92fee4542bf7e6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"_isAA81.tmp","sha256":"a79653e9f6c1cd1fee41316822b1954fc7ddc348218064d447f23be17cdfaeea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Agent.exe","sha256":"e9ba8c3f32eb58d9320fca9ed797b8fcdfb5d93ad000eb14d3cf5a68dca1e629","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"ISSetup.dll","sha256":"60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"layout.bin","sha256":"01fecc0d057b0ef9869252a17cfb6f6680ffe3069a4f13f1ad37f2d6c3cfa202","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"setup.inx","sha256":"23cabb1b4a802108b98d41c333c11cdb336f997776b2d3aa54367e8332028724","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"corA9BD.tmp","sha256":"f6d7bc8ca6550662166f34407968c7d3669613e50e98a4e40bec1589e74ff5d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"dotA9DE.tmp","sha256":"c7e5bdc4b79f7f8c68c5f09c0c055e97fb8c62fe1b5d469b3527ab6b767c8df2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"DIFA9AD.tmp","sha256":"6bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"FonA9AC.tmp","sha256":"a7e91b042ce33490353c00244c0420c383a837e73e6006837a60d3c174102932","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"InsA99B.tmp","sha256":"0d3e03b70a4df0f53f237c113e5efe503f2c69f28cfe22cb0171b82abb8d5cae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"StrAA00.tmp","sha256":"3c3d7da255fb0241c53e030035b443c2fc1c3ae84109041fcc53347881b6c2bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"defAA40.tmp","sha256":"8075162db275eb52f5d691b15fc0d970cb007f5bece33ce5db509edf51c1f020","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"setA95B.tmp","sha256":"23cabb1b4a802108b98d41c333c11cdb336f997776b2d3aa54367e8332028724","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"0x0409.ini","sha256":"8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"data1.cab","sha256":"f0ccee56adebb0a79b5b7980ab9106f54f94f827963ad8998ea811e42422596a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"data1.hdr","sha256":"d643003634136509aaf18480a62057c04b16754c58caa03dd1375c1bc1e7dafa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"setup.exe","sha256":"e9ba8c3f32eb58d9320fca9ed797b8fcdfb5d93ad000eb14d3cf5a68dca1e629","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\0x0409.ini","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\data1.cab","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\data1.hdr","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\ISSetup.dll","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\layout.bin","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\setup.exe","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\setup.ini","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Disk1\\setup.inx","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\setup.ini","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\Agent.exe","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\0x0409.ini","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{7F2A8B10-0140-436C-B079-A30E28BC39C1}\\ISSetup.dll","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\A8BE.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\setA95B.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\InsA99B.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\FonA9AC.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\DIFA9AD.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\corA9BD.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\dotA9CE.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\dotA9DE.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\ISBA9DF.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\StrAA00.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\isrAA01.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\defAA40.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\_isAA51.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%TEMP%\\{531BD515-73EA-42C0-8E91-C3796763B007}\\{417FCDE2-BCB2-4A7C-BC24-F539CD19209A}\\_isAA81.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%WINDIR%\\Temp\\DesktopCentralAgent_DC.txt","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%WINDIR%\\Temp\\ageC0F8.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%WINDIR%\\Temp\\UEMC195.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%WINDIR%\\Temp\\UEMCEA6.tmp","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%WINDIR%\\Temp\\DesktopCentralAgent.txt","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"path":"%WINDIR%\\Temp\\DCAgentServerInfo.json","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\%IS_PREREQ%-UEMSAGENT\\%IS_PREREQ%-UEMSAGENT","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\%IS_PREREQF%-UEMSAGENT\\%IS_PREREQF%-UEMSAGENT","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\ISSETUPPREREQUISISTES\\ISSETUPPREREQUISISTES","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2316:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2316:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:2316:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:2316:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4960:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:4960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:4960:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:4960:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:5772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:5772:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:3456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:3456:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:5016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:3428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:3428:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:3716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:3716:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:4240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:4240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6632:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6632:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6632:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"Local\\SM0:6632:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:6632:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]},{"name":"SM0:6632:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a8ff2c3eb78a7c103047b5b"}]}]}},"report_ids":{"sandbox_job_ids":["6a8ff2c3eb78a7c103047b5b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application Sample 4923d672142d… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4923d672142d…. Malware family: Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application. Threat score 85/100. 2/25 AV engines flagged this file. 3 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99"}],["$","meta","4",{"property":"og:title","content":"Malicious Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application Sample 4923d672142d… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4923d672142d…. Malware family: Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application. Threat score 85/100. 2/25 AV engines flagged this file. 3 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4923d672142d1a10eb96afd5dfe5f69638004a8a9d5738d8245d79a31c70df99"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application Sample 4923d672142d… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4923d672142d…. Malware family: Win32_RemoteAdmin_ManageEngine_B_potentially_unsafe_application. Threat score 85/100. 2/25 AV engines flagged this file. 3 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L60","11",{}]]