34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 69:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware_100.0 Sample 4a5e1c683876… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample 4a5e1c683876…. Malware family: Malware_100.0. Threat score 80/100. 1/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","keywords":["Malicious","Malware_100.0","malware analysis","sandbox report","threat intelligence","4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d"],"about":{"@type":"SoftwareApplication","name":"Imagine_2.8.0_x64_Unicode.exe","applicationCategory":["compressed","7zip"],"identifier":"4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"Malware_100.0","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T442,"Nullsoft Install System v3.02.1" - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Imagine 2.8.0 (64-bit)" - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Choose Components" - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Choose which features of Imagine you want to install." - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Check the components you want to install and uncheck the components you don't want to install. Click Next to continue." - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Select components to install:" - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Space required: 4.8 MB" - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Choose Users" - (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetWindowTextW" with parameter "Choose for which users you want to install Imagine." - (UID: 00000000-00006676)3e:T237c,"Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000ecf419006820fd7602000000000000009ed4db9c109a8774000000002cf51900201b0277ffffffff3cf519005810fd763c10fd764ed5db9c109a8774d4458774d84587741cf5190018f519000d0000000d00000090038974dc548b74000000006cac8874d8588b74b0f51900608d00773a35cbebfeffffff48f51900900ffd769003897458f5190084d48874dc548b749003897464f51900a4d488749003897480f519001a9a877490038974528bfc76010000000100000017d48874c0f5190086ca8874000000004aca8874fc7efb9b010000000100000000000000000000000000000090f519003dba19f400f61900f0cc887484a769effeffffff (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000004f00140000000000000000007b0094084f007b23718f57b440ed0000040030df3d8980e89103b0e87f77ff715899feffffff90e8910340697b000000c17630fa2c74d4477c77c5477c7787b440ed0000000080c32d743981335c84e8910314eb9103b0ac4174ffffffffc4e8910372fa2c7414eb91037cce1e7472fa2c740100000000000000020000007cce1e74f8e891030000000080c32d7480fa2c740000000020eb91037c0bd67610aae276ed81335c (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000008100b1ca7c7700a6810000000000200000000000000000007b00000000001800000048af7f00000000000400000034d8e3760000000007003200c8e491030400000000000000000000005ce59103cf63817704000000898d335cd4e4910320e89103b0ac4174ffffffff14e5910372fa2c74b1ca7c777cce1e7472fa2c740100000000000000020000007cce1e7440e591037ceb91036494830080fa2c74bc647f7740000000d0074f0000000000bd8d335c (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000000043003a005c00550020000000d0074f0000004f00000000000000000000000000285b82000000000000000000000000000200000020000000c8014f00000000000400000000004f00120000000000000000007b00c98e335c94e7910328e89103b0ac4174ffffffffd0e7910372fa2c74120000007cce1e7472fa2c740100000000000000020000007cce1e74fce79103bcc083000000000080fa2c7410000000fcffffff00000000d0e79103 (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000910310d791031cd791030cd791030202000048d79103b005ec76eada91039002ec76c105ec76bcda9103ffffffff80d7910384d791030000000010d79103be397c7768467d000000000000000000000000000000000099bf335ce4d6910330da9103b0ac4174ffffffff24d7910372fa2c74fcd691037cce1e7472fa2c740100000000000000020000007cce1e7450d791038cdd91036494830080fa2c74a294d37629000000d8cf8300000000004dbe335c (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000ec027b00c0d69103b4d8910300007b000000000000000000000000000000000000000000000000002000000016001900c86f830018718300b1ca7c771871830000000000280000004200327434d891030000000099bf335ce4d6910330da9103b0ac4174ffffffff24d7910372fa2c74fcd691037cce1e7472fa2c740100000000000000020000007cce1e7450d791038cdd910314d9830080fa2c74a294d3762a00000098d08300000000004dbe335c (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000007c77e78b40ed001000000810000000007b0031009103b78a40ed1cd691037cd6910344eb91035c0000008d01008cdcd89103caff7a77d6d98300d0d691035c0000000200000280d991036da000cd34d891030000000099bf335ce4d6910330da9103b0ac4174ffffffff24d7910372fa2c74fcd691037cce1e7472fa2c740100000000000000020000007cce1e7450d791038cdd91036494830080fa2c74a294d37626000000181f8400000000004dbe335c (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031009103b78a40ed1cd691037cd6910344eb91035c000000d6d98300dcd89103caff7a77d6d98300d0d69103dfe97c77278440ed000800000808000000007b000000000099bf335ce4d6910330da9103b0ac4174ffffffff24d7910372fa2c74fcd691037cce1e7472fa2c740100000000000000020000007cce1e7450d791038cdd91036494830080fa2c74a294d37629000000f8d08300000000004dbe335c (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031009103b78a40ed1cd691037cd6910344eb91035c000000d6d98300dcd89103caff7a77d6d98300d0d691035c000000b8d9830080d99103f2ff7a7700007b000000000099bf335ce4d6910330da9103b0ac4174ffffffff24d7910372fa2c74fcd691037cce1e7472fa2c740100000000000000020000007cce1e7450d791038cdd91032c35840080fa2c74a294d37627000000d8218400000000004dbe335c (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031009103b78a40ed1cd691037cd6910344eb91035c000000d6d98300dcd89103caff7a77d6d98300d0d691035c000000b8d9830080d99103f2ff7a7700007b000000000099bf335ce4d6910330da9103b0ac4174ffffffff24d7910372fa2c74fcd691037cce1e7472fa2c740100000000000000020000007cce1e7450d791038cdd91036c46840080fa2c74a294d3762a00000058ce8300000000004dbe335c (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031009103b78a40ed1cd691037cd6910344eb91035c000000d6d98300dcd89103caff7a77d6d98300d0d691035c000000b8d9830080d99103f2ff7a7700007b000000000099bf335ce4d6910330da9103b0ac4174ffffffff24d7910372fa2c74fcd691037cce1e7472fa2c740100000000000000020000007cce1e7450d791038cdd9103cc4a840080fa2c74a294d37629000000d8cc8300000000004dbe335c (UID: 00000000-00006676)3f:T8e4,"Imagine_2.8.0_x64_Unicode.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000074f0000004f00726eb47400000000feffffffa0ac7f0000000000000000004cf319000200000010000000c0014f00000000000200000000004f00010000000800000000007b009c0a4f00e2f4b174980a4f0058f31900feba7c77080000000000000008000000515c31b39cf51900da91e07300007b000800000001000000 (UID: 00000000-00006676) "Imagine64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003480) "Imagine64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004044) "Imagine64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007436) "Imagine64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002868) "Imagine64.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000532)40:T424,"Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter %TEMP%\nse258E.tmp (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter %TEMP%\nsr5F4C.tmp (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "CreateDirectoryW" with parameter %TEMP%\nsr5F4C.tmp\Language (UID: 00000000-00006676)41:T11be,"Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %TEMP%\nse258E.tmp\UserInfo.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %TEMP%\nse258E.tmp\System.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RichEd20.dll (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "LoadLibrary" with a parameter %TEMP%\nse258E.tmp\nsDialogs.dll (UID: 00000000-00006676) "Imagine64.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003480) "Imagine64.exe" called "LoadLibrary" with a parameter %TEMP%\nsr5F4C.tmp\Imagine64.dll (UID: 00000000-00003480) "Imagine64.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003480) "Imagine64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003480) "Imagine64.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004044) "Imagine64.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Imagine\Imagine64.dll (UID: 00000000-00004044) "Imagine64.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004044) "Imagine64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004044) "Imagine64.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Imagine\Imagine64.dll (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007436) "Imagine64.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002868) "Imagine64.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Imagine\Imagine64.dll (UID: 00000000-00002868) "Imagine64.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002868) "Imagine64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002868) "Imagine64.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002868) "Imagine64.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000532) "Imagine64.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Imagine\Imagine64.dll (UID: 00000000-00000532) "Imagine64.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000532) "Imagine64.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000532) "Imagine64.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000532)42:T3d40,"Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter GetAccountType (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter Create (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter CreateControl (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter Show (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00006676) "Imagine64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter GetPluginInterface (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter Module32FirstW (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter Module32NextW (UID: 00000000-00003480) "Imagine64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter GetPluginInterface (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004044) "Imagine64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter GetPluginInterface (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00007436) "Imagine64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter GetPluginInterface (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00002868) "Imagine64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetMalloc (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter GetPluginInterface (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000532) "Imagine64.exe" called "GetProcAddress" with a parameter RegDeleteKeyW (UID: 00000000-00000532)43:T442,Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp")44:T9a8,Process Imagine_2.8.0_x64_Unicode.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6676:64:WilError_03" Process Imagine_2.8.0_x64_Unicode.exe created mutex with name "Local\SM0:6676:168:WilStaging_02" Process Imagine_2.8.0_x64_Unicode.exe created mutex with name "SM0:6676:64:WilError_03" Process Imagine_2.8.0_x64_Unicode.exe created mutex with name "Local\SM0:6676:64:WilError_03" Process Imagine_2.8.0_x64_Unicode.exe created mutex with name "SM0:6676:168:WilStaging_02" Process Imagine_2.8.0_x64_Unicode.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6676:168:WilStaging_02" Process Imagine_2.8.0_x64_Unicode.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6676:168:WilStaging_02" Process Imagine_2.8.0_x64_Unicode.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6676:64:WilError_03" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3480:304:WilStaging_02" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3480:304:WilStaging_02" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3480:120:WilError_03" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3480:120:WilError_03" Process Imagine64.exe created mutex with name "Local\SM0:3480:304:WilStaging_02" Process Imagine64.exe created mutex with name "Local\SM0:3480:120:WilError_03" Process Imagine64.exe created mutex with name "SM0:3480:304:WilStaging_02" Process Imagine64.exe created mutex with name "SM0:3480:120:WilError_03" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4044:304:WilStaging_02" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4044:304:WilStaging_02" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4044:120:WilError_03" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4044:120:WilError_03" Process Imagine64.exe created mutex with name "Local\SM0:4044:304:WilStaging_02" Process Imagine64.exe created mutex with name "SM0:4044:120:WilError_03" Process Imagine64.exe created mutex with name "Local\SM0:4044:120:WilError_03" Process Imagine64.exe created mutex with name "SM0:4044:304:WilStaging_02" Process Imagine64.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7436:304:WilStaging_02"45:T1192,Antivirus vendors marked dropped file "Uninstall.exe" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"), Antivirus vendors marked dropped file "System.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "nsDialogs.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "UserInfo.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "Imagine.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Imagine\Imagine64.exe" MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 29 15:00:00 2026 atime=Fri Nov 6 00:03:05 2026 mtime=Thu Oct 29 15:00:00 2026 length=15360 window=normal IDListSize 0x01cc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Imagine64.exe""), Antivirus vendors marked dropped file "Uninstall.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Imagine\Uninstall.exe" MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Fri Nov 6 00:02:38 2026 atime=Fri Nov 6 00:02:38 2026 mtime=Fri Nov 6 00:02:38 2026 length=51853 window=normal IDListSize 0x01cc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Uninstall.exe""), Antivirus vendors marked dropped file "Imagine.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Imagine\Imagine64.exe" MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 29 15:00:00 2026 atime=Fri Nov 6 00:03:11 2026 mtime=Thu Oct 29 15:00:00 2026 length=15360 window=normal IDListSize 0x01cc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Imagine64.exe""), Antivirus vendors marked dropped file "What_s new.lnk" as clean (type is "Unknown"), Antivirus vendors marked dropped file "Imagine Help.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 29 15:00:00 2026 atime=Fri Nov 6 00:02:38 2026 mtime=Thu Oct 29 15:00:00 2026 length=22336 window=normal IDListSize 0x01c6 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Imagine.chm""), Antivirus vendors marked dropped file "Readme.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 29 15:00:00 2026 atime=Fri Nov 6 00:02:38 2026 mtime=Thu Oct 29 15:00:00 2026 length=2704 window=normal IDListSize 0x01c4 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Readme.txt""), Antivirus vendors marked dropped file "PlugInst.inf" as clean (type is "ISO-8859 text with CRLF line terminators"), Antivirus vendors marked dropped file "Imagine.wdx64" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "Imagine.wcx64" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"), Antivirus vendors marked dropped file "Imagine.wlx64" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"), Antivirus vendors marked dropped file "Imagine64.dll" as clean (type is "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "Imagine.chm" as clean (type is "MS Windows HtmlHelp Data"), Antivirus vendors marked dropped file "Imagine64.exe" as clean (type is "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections")46:T165b,"e\Software\C" in Source: 00000000-00000532.00000000.318547.00500000.00000004.mdmp "e\Software\C" in Source: 00000000-00002868.00000000.318545.0044C000.00000004.mdmp "e\Software\C" in Source: 00000000-00003480.00000000.316488.004B0000.00000004.mdmp "e\Software\C" in Source: 00000000-00004044.00000000.316839.005F0000.00000004.mdmp "\Registry\Machine\Software\C" in Source: 00000000-00004044.00000000.316839.005F0000.00000004.mdmp "\Registry\Machine\Software\Class" in Source: 00000000-00004044.00000000.316839.005F0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004044.00000000.316839.005F0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004044.00000000.316839.005F0000.00000004.mdmp "e\Software\C" in Source: 00000000-00004044.00000001.317317.005F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Imagine" in Source: 00000000-00006676.00000000.315390.007B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00006676.00000001.317311.00408000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Imagine" in Source: 00000000-00006676.00000001.317311.0040A000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Imagine" in Source: 00000000-00006676.00000001.317311.007B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006676.00000001.317311.007B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006676.00000001.317311.007B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Imagine" in Source: 00000000-00006676.00000002.319232.007B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006676.00000002.319232.007B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006676.00000002.319232.007B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006676.00000002.319232.007B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Pr" in Source: 00000000-00006676.00000002.319232.007B0000.00000004.mdmp "Software\Microsoft\Input" in Source: 00000000-00006676.00000002.319232.73A41000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00006676.00000002.319232.73A41000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00006676.00000002.319232.73A41000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00006676.00000002.319232.73A41000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Imagine" in Source: 00000000-00006676.00000003.319323.007D1000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006676.00000003.319323.007D1000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006676.00000003.319323.00821000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006676.00000003.319323.00821000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Pr" in Source: 00000000-00006676.00000003.319323.00821000.00000004.mdmp "e\Software\C" in Source: 00000000-00007436.00000000.317640.005A0000.00000004.mdmp "Software\Classes\" in Source: 00000000-00007436.00000000.317640.50280000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.%s\UserChoice" in Source: 00000000-00007436.00000000.317640.50280000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" in Source: 00000000-00007436.00000000.317640.50280000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00007436.00000000.317640.50280000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007436.00000000.317640.50280000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo" in Source: 00000000-00007436.00000000.317640.50280000.00000002.mdmp "e\Software\C" in Source: 00000000-00007436.00000001.318586.005A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007436.00000001.318586.040D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007436.00000001.318586.040FF000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007436.00000001.318586.040FF000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007436.00000001.318586.040FF000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007436.00000001.318586.040FF000.00000004.mdmp "1-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007436.00000001.318586.040FF000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007436.00000001.318586.040FF000.00000004.mdmp47:T173a,"Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 749e0000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74c80000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 74d00000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 76510000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "NTDLL.DLL" at base 77780000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74b80000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74910000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 748e0000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 748d0000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 74870000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 77120000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 75470000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 74860000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "KERNEL32.DLL" at base 76eb0000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "COMCTL32.DLL" at base 75200000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "RPCRT4.DLL" at base 77560000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%TEMP%\NSE258E.TMP\USERINFO.DLL" at base 10000000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%TEMP%\NSE258E.TMP\SYSTEM.DLL" at base 10000000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\RICHED20.DLL" at base 73da0000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "COMCTL32" at base 75200000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76b30000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%TEMP%\NSE258E.TMP\NSDIALOGS.DLL" at base 2580000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76950000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76110000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76110000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 774e0000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77620000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75930000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 73a40000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "KERNELBASE" at base 76c10000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 74190000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74190000 "Imagine_2.8.0_x64_Unicode.exe" loaded module "CSCAPI.DLL" at base 73930000 "Imagine64.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb4edd0000 "Imagine64.exe" loaded module "SHELL32.DLL" at base 7ffb77e40000 "Imagine64.exe" loaded module "KERNEL32.DLL" at base 7ffb77c10000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb73900000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb70060000 "Imagine64.exe" loaded module "%TEMP%\NSR5F4C.TMP\IMAGINE64.DLL" at base 50000000 "Imagine64.exe" loaded module "COMCTL32.DLL" at base 7ffb61810000 "Imagine64.exe" loaded module "USER32.DLL" at base 7ffb76db0000 "Imagine64.exe" loaded module "%LOCALAPPDATA%\IMAGINE\IMAGINE64.DLL" at base 50000000 "Imagine64.exe" loaded module "RPCRT4.DLL" at base 7ffb773e0000 "Imagine64.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffb77500000 "Imagine64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffb76db0000 "Imagine64.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffb76db0000 "Imagine64.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffb77940000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffb77a10000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffb775d0000 "Imagine64.exe" loaded module "COMCTL32" at base 7ffb61810000 "Imagine64.exe" loaded module "UXTHEME.DLL" at base 7ffb73900000 "Imagine64.exe" loaded module "ADVAPI32.DLL" at base 7ffb77940000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb742d0000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffb60e40000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffb67050000 "Imagine64.exe" loaded module "SSPICLI.DLL" at base 7ffb75570000 "Imagine64.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffb766f0000 "Imagine64.exe" loaded module "VIRTDISK.DLL" at base 7ffb61e00000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffb74190000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffb5ca10000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffb6f2b0000 "Imagine64.exe" loaded module "NTDLL.DLL" at base 7ffb78eb0000 "Imagine64.exe" loaded module "KERNELBASE" at base 7ffb766f0000 "Imagine64.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 7ffb6e6b0000 "Imagine64.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb766f0000 "Imagine64.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb766f0000 "Imagine64.exe" loaded module "KERNEL32" at base 7ffb77c10000 "Imagine64.exe" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 7ffb766f000048:T688,"Imagine_2.8.0_x64_Unicode.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Imagine_2.8.0_x64_Unicode.exe" was detected as "Microsoft Linker" and name: "Linker" "Imagine64.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Imagine64.dll" was detected as "Microsoft Linker" and name: "Linker" "Uninstall.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Uninstall.exe" was detected as "Microsoft Linker" and name: "Linker" "Imagine64.exe" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Imagine64.exe" was detected as "Microsoft Linker" and name: "Linker" "System.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "System.dll" was detected as "Microsoft Linker" and name: "Linker" "nsDialogs.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "nsDialogs.dll" was detected as "Microsoft Linker" and name: "Linker" "UserInfo.dll" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "UserInfo.dll" was detected as "Microsoft Linker" and name: "Linker" "Imagine.wdx64" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Imagine.wdx64" was detected as "Microsoft Linker" and name: "Linker" "Imagine.wcx64" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Imagine.wcx64" was detected as "Microsoft Linker" and name: "Linker" "Imagine.wlx64" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Imagine.wlx64" was detected as "Microsoft Linker" and name: "Linker"49:T969,"Imagine_2.8.0_x64_Unicode.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Imagine_2.8.0_x64_Unicode.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "Imagine_2.8.0_x64_Unicode.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "Imagine_2.8.0_x64_Unicode.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "Imagine_2.8.0_x64_Unicode.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "Imagine_2.8.0_x64_Unicode.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Imagine_2.8.0_x64_Unicode.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Imagine_2.8.0_x64_Unicode.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Imagine_2.8.0_x64_Unicode.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "Imagine_2.8.0_x64_Unicode.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "Imagine_2.8.0_x64_Unicode.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "Imagine64.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}") "Imagine64.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Imagine64.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "Imagine64.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "Imagine64.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "Imagine64.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")4a:T565,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00006676-00000C2B-3090813132] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00006676-00000C2B-3090870147] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00006676-00000C2B-3090931587] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00006676-00000C2B-3091116516] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00006676-00000C2B-3091160644] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00006676-00000C2B-3091199694] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00006676-00000C2B-3091252102] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00006676-00000C2B-3091307833] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00006676-00000C2B-3091362556] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00006676-00000C2B-3091397303] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00006676-00000C2B-3091432349] Observed system executable string:"%WINDIR%\system32\RichEd20.dll" [Source: 00000000-00006676-00000C2B-3092553525]4b:T33f4,"Imagine64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine64.dll]- [targetUID: 00000000-00000532] "Uninstall.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\Imagine\Uninstall.exe]- [targetUID: 00000000-00006676] "Imagine.chm" has type "MS Windows HtmlHelp Data"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.chm]- [targetUID: 00000000-00006676] "Imagine64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine64.exe]- [targetUID: 00000000-00007436] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse258E.tmp\System.dll]- [targetUID: 00000000-00006676] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nse258E.tmp\nsDialogs.dll]- [targetUID: 00000000-00006676] "UserInfo.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse258E.tmp\UserInfo.dll]- [targetUID: 00000000-00006676] "Imagine.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Imagine\Imagine64.exe" MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 29 15:00:00 2026 atime=Fri Nov 6 00:03:05 2026 mtime=Thu Oct 29 15:00:00 2026 length=15360 window=normal IDListSize 0x01cc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Imagine64.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine.lnk]- [targetUID: 00000000-00006676] "Uninstall.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Imagine\Uninstall.exe" MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Fri Nov 6 00:02:38 2026 atime=Fri Nov 6 00:02:38 2026 mtime=Fri Nov 6 00:02:38 2026 length=51853 window=normal IDListSize 0x01cc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Uninstall.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Uninstall.lnk]- [targetUID: 00000000-00006676] "Imagine.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded HasExpIcon "%USERPROFILE%\AppData\Local\Imagine\Imagine64.exe" MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 29 15:00:00 2026 atime=Fri Nov 6 00:03:11 2026 mtime=Thu Oct 29 15:00:00 2026 length=15360 window=normal IDListSize 0x01cc Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Imagine64.exe""- Location: [%USERPROFILE%\Desktop\Imagine.lnk]- [targetUID: 00000000-00006676] "What_s new.lnk" has type "Unknown"- [targetUID: N/A] "Imagine Help.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 29 15:00:00 2026 atime=Fri Nov 6 00:02:38 2026 mtime=Thu Oct 29 15:00:00 2026 length=22336 window=normal IDListSize 0x01c6 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Imagine.chm""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine Help.lnk]- [targetUID: 00000000-00006676] "Readme.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID tneg7yzfh633lpq KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Thu Oct 29 15:00:00 2026 atime=Fri Nov 6 00:02:38 2026 mtime=Thu Oct 29 15:00:00 2026 length=2704 window=normal IDListSize 0x01c4 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Local\Imagine\Readme.txt""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Readme.lnk]- [targetUID: 00000000-00006676] "PlugInst.inf" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\PlugInst.inf]- [targetUID: 00000000-00006676] "nso257D.tmp" has type "data"- Location: [%TEMP%\nso257D.tmp]- [targetUID: 00000000-00006676] "Whatsnew.txt" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Whatsnew.txt]- [targetUID: 00000000-00006676] "Portuguese _Portugal_.lng" has type "Unknown"- [targetUID: N/A] "Russian.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Russian.lng]- [targetUID: 00000000-00006676] "Ukrainian.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Ukrainian.lng]- [targetUID: 00000000-00006676] "Romanian.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Romanian.lng]- [targetUID: 00000000-00006676] "Polish.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Polish.lng]- [targetUID: 00000000-00006676] "Czech.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Czech.lng]- [targetUID: 00000000-00000532] "Danish.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Danish.lng]- [targetUID: 00000000-00006676] "Turkish.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Turkish.lng]- [targetUID: 00000000-00006676] "German.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\German.lng]- [targetUID: 00000000-00006676] "Japanese.lng" has type "Non-ISO extended-ASCII text with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Japanese.lng]- [targetUID: 00000000-00006676] "Korean.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Korean.lng]- [targetUID: 00000000-00006676] "Italiano.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Italiano.lng]- [targetUID: 00000000-00006676] "TraditionalChinese.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\TraditionalChinese.lng]- [targetUID: 00000000-00006676] "SimplifiedChinese.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\SimplifiedChinese.lng]- [targetUID: 00000000-00006676] "Spanish.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Spanish.lng]- [targetUID: 00000000-00006676] "French.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\French.lng]- [targetUID: 00000000-00006676] "Dutch.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Dutch.lng]- [targetUID: 00000000-00006676] "Portuguese _Brazil_.lng" has type "Unknown"- [targetUID: N/A] "Slovenian.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Slovenian.lng]- [targetUID: 00000000-00006676] "Uzbek _O_zbekcha_.lng" has type "Unknown"- [targetUID: N/A] "Arabic.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Arabic.lng]- [targetUID: 00000000-00006676] "Imagine.wdx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wdx64]- [targetUID: 00000000-00006676] "Imagine.wcx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wcx64]- [targetUID: 00000000-00006676] "Imagine.wlx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wlx64]- [targetUID: 00000000-00006676] "Readme.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Readme.txt]- [targetUID: 00000000-00006676] "Imagine.ini" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Imagine.ini]- [targetUID: 00000000-00000532] "dir.txt" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Plugin\dir.txt]- [targetUID: 00000000-00006676] "Imagine64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine64.dll]- [targetUID: 00000000-00000532] "Imagine.chm" has type "MS Windows HtmlHelp Data"- Location: [%LOCALAPPDATA%\Imagine\Imagine.chm]- [targetUID: 00000000-00006676] "Imagine64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine64.exe]- [targetUID: 00000000-00007436] "PlugInst.inf" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\PlugInst.inf]- [targetUID: 00000000-00006676] "Whatsnew.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Whatsnew.txt]- [targetUID: 00000000-00006676] "Russian.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Russian.lng]- [targetUID: 00000000-00006676] "Ukrainian.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Ukrainian.lng]- [targetUID: 00000000-00006676] "Romanian.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Romanian.lng]- [targetUID: 00000000-00006676] "Polish.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Polish.lng]- [targetUID: 00000000-00006676] "Czech.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Czech.lng]- [targetUID: 00000000-00000532] "Danish.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Danish.lng]- [targetUID: 00000000-00006676] "Turkish.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Turkish.lng]- [targetUID: 00000000-00006676] "German.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\German.lng]- [targetUID: 00000000-00006676] "Japanese.lng" has type "Non-ISO extended-ASCII text with CRLF NEL line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Japanese.lng]- [targetUID: 00000000-00006676] "Korean.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Korean.lng]- [targetUID: 00000000-00006676] "Italiano.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Italiano.lng]- [targetUID: 00000000-00006676] "TraditionalChinese.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\TraditionalChinese.lng]- [targetUID: 00000000-00006676] "SimplifiedChinese.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\SimplifiedChinese.lng]- [targetUID: 00000000-00006676] "Spanish.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Spanish.lng]- [targetUID: 00000000-00006676] "French.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\French.lng]- [targetUID: 00000000-00006676] "Dutch.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Dutch.lng]- [targetUID: 00000000-00006676] "Slovenian.lng" has type "Non-ISO extended-ASCII text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Language\Slovenian.lng]- [targetUID: 00000000-00006676] "Arabic.lng" has type "ISO-8859 text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Language\Arabic.lng]- [targetUID: 00000000-00006676] "Imagine.wdx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine.wdx64]- [targetUID: 00000000-00006676] "Imagine.wcx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine.wcx64]- [targetUID: 00000000-00006676] "Imagine.wlx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine.wlx64]- [targetUID: 00000000-00006676] "Readme.txt" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Imagine\Readme.txt]- [targetUID: 00000000-00006676] "dir.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\nsr5F4C.tmp\Plugin\dir.txt]- [targetUID: 00000000-00006676]4c:T679,"Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}\"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}\"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}\"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")4d:Tbc2,"Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "DATA"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{60982E44-40A2-4367-9BC3-CA978A87EFC7}"; Key: "GENERATION"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "DATA"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}"; Key: "GENERATION"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "DATA"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{FFA98E4B-99DB-4018-B974-2DFFBCBAF986}"; Key: "GENERATION"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "IMAGINE_2.8.0_X64_UNICODE.EXE"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "")4e:T570,"Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\Imagine_2.8.0_x64_Unicode.exe.Local\" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\COMCTL32.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\WINDOWS\SysWOW64\oleaut32.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\windows\temp\VxSSL32.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\FLTLIB.DLL" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\WINDOWS\SysWOW64\FLTLIB.DLL" "Imagine_2.8.0_x64_Unicode.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll"4f:T810,"Imagine_2.8.0_x64_Unicode.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu" "Imagine_2.8.0_x64_Unicode.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" "Imagine_2.8.0_x64_Unicode.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Imagine_2.8.0_x64_Unicode.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine Help.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\Readme.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\What's new.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\Uninstall.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu" "Imagine_2.8.0_x64_Unicode.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs" "Imagine_2.8.0_x64_Unicode.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Imagine_2.8.0_x64_Unicode.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine Help.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Readme.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\What's new.lnk" "Imagine_2.8.0_x64_Unicode.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Uninstall.lnk" "Imagine64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Imagine64.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"50:T654,"Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine Help.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\Readme.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\What's new.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Imagine\Uninstall.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "C:\Users\%OSUSER%\Desktop\Imagine.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine Help.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Readme.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\What's new.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Uninstall.lnk" "Imagine_2.8.0_x64_Unicode.exe" trying to access LNK file "%USERPROFILE%\Desktop\Imagine.lnk"51:T8e9,"Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\MSVCP140.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse258E.tmp\UserInfo.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse258E.tmp\System.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nse258E.tmp\nsDialogs.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.exe" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.dll" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Imagine\Uninstall.exe" "Imagine64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\FLTLIB.DLL" "Imagine64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\MSVCP140.dll" "Imagine64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\VCRUNTIME140.dll" "Imagine64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\VCRUNTIME140_1.dll" "Imagine64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\CRYPTSP.DLL" "Imagine64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\profapi.dll"52:T5de,"Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Imagine_2.8.0_x64_Unicode.exe.Local\" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.dll.Config" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Imagine" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.chm" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wcx64" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wdx64" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wlx64" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\PlugInst.inf" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Readme.txt" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Whatsnew.txt" "Imagine_2.8.0_x64_Unicode.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Arabic.lng"53:Tbb2,Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00006676.00000000.315390.0040A000.00000004.mdmp") Found URL "http://www.nyam.pe.krurlinfoaboutinstallsourcenomodifynorepairuninstallstringuninstall.exe" - Source: "00000000-00006676.00000000.315390.007B0000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00006676.00000001.317311.0040A000.00000004.mdmp") Found URL "http://www.nyam.pe.krurlinfoaboutinstallsourcenomodifynorepairuninstallstringuninstall.exe" - Source: "00000000-00006676.00000001.317311.007B0000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00006676.00000002.319232.0040A000.00000004.mdmp") Found URL "http://www.nyam.pe.krurlinfoaboutinstallsourcenomodifynorepairuninstallstringuninstall.exe" - Source: "00000000-00006676.00000002.319232.007B0000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00006676.00000003.319323.0040A000.00000004.mdmp") Found URL "http://www.nyam.pe.krurlinfoaboutinstallsourcenomodifynorepairuninstallstringuninstall.exe" - Source: "00000000-00006676.00000003.319323.007D1000.00000004.mdmp") Found URL "https://www.google.com/maps/place/,showiconsinmenuitemscanvasbackgroundcolortransparentpreserveaspectratiocapturewindowsavedirectorysavefiletypesavetoincludemousecursoronlyclientareaautomatictimerdelayhotkeymethodareacommandusecustomimagecustomimagecontextmenuheightcontextmenuwidthcolormanagementoutputiccprofilefilenamedefaultinputiccprofilefilenametransformationmethodoutputiccprofiledefaultinputiccprofileenabledfullscreenhidescrollbarshidecursoractivateatstartupshowfilenameoption\%s\%s.ini%s.iniindividualoptionperuserlanguagelanguage\textfilefontfontsizenotshowstatusbarinquickviewnotshowtoolbarinquickviewusemultithreadingwhenavailableaddextensionwithcapitallettersasktosavechangesatexitignoreerrorsrenameincorrectextensionnotnotifyloopdirloopdirasktooverwritemouseitemcountmodenumbermrudfile%dmrudcountmrudusewidthheightbitcountgrayscalelaunchpainttoolboxparameterpathprogram%dpagenavigatorthumbnailheightshowpagenavigatorpaintforegroundcolorforegroundcolorrgbbackgroundcolorrgbpencilshapepencilsizefilltolerancecolorreplaceshapecolorreplacesizecolorreplacetolerancetextantialiasingerasershapeerasersizeeraserstrengthlinesizecircleellipsecirclesizecirclefillrectanglesquarerectanglesizerectanglefillprintorientationdefaultdpicenterimagesizesmoothscrollfrequencysmoothscrollscrolllinestephortcutlideshoweffecttypedelayflagsstatusbarthemetoolbaruseundomenubardisplayloadtimeimagefitmodedisplayfrequencywhileloadingantialiasingdisplaywhileloadingwindowcaptioncustommaskwindowcaptionformatshowfullpathintitlebarcenterwindowwindowfitmodezoommousepositionbasedpagenavigatorsplitterratiopagenavigator%d/%d" - Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found URL "http://ns.adobe.com/xap/1.0/@+(pcommentraw" - Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp")54:Ta1d,Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "57981699630,4420,104,,GetKeyState,user32.dll,"01:23:09.328",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006676.00000003.319323.00821000.00000004.mdmp") Found reference to API "57984649022,4420,104,,GetKeyState,user32.dll,"01:23:09.328",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00006676.00000003.319323.00821000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "6745598194,3964,104,,GetKeyState,user32.dll,"01:22:57.843",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007436.00000001.318586.040A0000.00000004.mdmp") Found reference to API "6746064176,3964,104,,GetKeyState,user32.dll,"01:22:57.843",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007436.00000001.318586.040A0000.00000004.mdmp") Found reference to API "6749589698,3964,104,,GetKeyState,user32.dll,"01:22:57.843",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007436.00000001.318586.040A0000.00000004.mdmp") Found reference to API "6745709222,3964,104,,GetKeyState,user32.dll,"01:22:57.843",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007436.00000001.318586.040A0000.00000004.mdmp") Found reference to API "6748665868,3964,104,,GetKeyState,user32.dll,"01:22:57.843",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007436.00000001.318586.040A0000.00000004.mdmp")55:T59f,file/memory contains long string with (Indicator: "GetUserName"; File: "UserInfo.dll") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "UserInfo.dll") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006676.00000000.315390.0040A000.00000004.mdmp, 00000000-00006676.00000001.317311.0040A000.00000004.mdmp, 00000000-00006676.00000002.319232.0040A000.00000004.mdmp, 00000000-00006676.00000003.319323.0040A000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006676.00000000.315390.0040A000.00000004.mdmp, 00000000-00006676.00000001.317311.0040A000.00000004.mdmp, 00000000-00006676.00000002.319232.0040A000.00000004.mdmp, 00000000-00006676.00000003.319323.0040A000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp")56:T647,"Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter %TEMP%\nse258E.tmp (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Imagine (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter %TEMP%\nsr5F4C.tmp (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter %TEMP%\nsr5F4C.tmp\Imagine.ini (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindFirstFileW" with parameter %TEMP%\nsr5F4C.tmp\*.* (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindNextFileW" with parameter Imagine.chm (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindNextFileW" with parameter Imagine.wcx64 (UID: 00000000-00006676) "Imagine_2.8.0_x64_Unicode.exe" called "FindNextFileW" with parameter Imagine.wdx64 (UID: 00000000-00006676)57:T950,"Imagine_2.8.0_x64_Unicode.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "2" "th32ProcessID": "0"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "4"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "92"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "372"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "516"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "624"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "616"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "688"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "756"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "776"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "884"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "912"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "920"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "1000"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "484"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "8"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "1092"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "1116"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "1140"} "Imagine64.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "1244"}58:T6a5,file/memory contains long string with (Indicator: "aes"; File: "Portuguese _Brazil_.lng") Found string "IPF_Base64InkSerializedFormatWWW" (Indicator: "base64"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found string "IPF_Base64GIFWWWh" (Indicator: "base64"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found string "Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi" (Indicator: "base64"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found string "Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1" (Indicator: "base64"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00007436.00000001.318586.02E00000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00007436.00000001.318586.02E00000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00007436.00000001.318586.02E00000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00007436.00000001.318586.02E00000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00007436.00000001.318586.06120000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00007436.00000001.318586.06120000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00007436.00000001.318586.06120000.00000002.mdmp")59:T1b9a,Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.exe" (Indicator: "\Device\"; Source: "00000000-00006676-00000BC0-3106896240") Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Indicator: "\Device\"; Source: "00000000-00006676-00000BC0-3112366226") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000532.00000000.318547.00500000.00000004.mdmp, 00000000-00000532.00000000.318547.023D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000532.00000000.318547.00500000.00000004.mdmp, 00000000-00000532.00000000.318547.023D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000532.00000000.318547.00500000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002868.00000000.318545.00420000.00000004.mdmp, 00000000-00002868.00000000.318545.024D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002868.00000000.318545.00420000.00000004.mdmp, 00000000-00002868.00000000.318545.024D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002868.00000000.318545.00420000.00000004.mdmp") Found string "Device\HarddiskVolume3\DosDevices\C:\??\Volume{44294f7c-6083-41c6-8176-3c202d755616}" (Indicator: "\DosDevices\"; Source: "00000000-00002868.00000000.318545.0044C000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003480.00000000.316488.004B0000.00000004.mdmp, 00000000-00003480.00000000.316488.02410000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003480.00000000.316488.004B0000.00000004.mdmp, 00000000-00003480.00000000.316488.02410000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003480.00000000.316488.004B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004044.00000000.316839.005F0000.00000004.mdmp, 00000000-00004044.00000000.316839.02310000.00000004.mdmp, 00000000-00004044.00000000.316839.02340000.00000004.mdmp, 00000000-00004044.00000001.317317.005F0000.00000004.mdmp, 00000000-00004044.00000001.317317.02340000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004044.00000000.316839.005F0000.00000004.mdmp, 00000000-00004044.00000000.316839.02310000.00000004.mdmp, 00000000-00004044.00000000.316839.02340000.00000004.mdmp, 00000000-00004044.00000001.317317.005F0000.00000004.mdmp, 00000000-00004044.00000001.317317.02340000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004044.00000000.316839.005F0000.00000004.mdmp, 00000000-00004044.00000001.317317.005F0000.00000004.mdmp") Found string "s\System32\Drivers\DriverDatY" (Indicator: "\drivers\"; Source: "00000000-00006676.00000000.315390.007B0000.00000004.mdmp, 00000000-00006676.00000001.317311.007B0000.00000004.mdmp, 00000000-00006676.00000002.319232.007B0000.00000004.mdmp, 00000000-00006676.00000003.319323.007B0000.00000004.mdmp") Found string "s\System32\Drivers\DriverDatY" (Indicator: "system32\drivers"; Source: "00000000-00006676.00000000.315390.007B0000.00000004.mdmp, 00000000-00006676.00000001.317311.007B0000.00000004.mdmp, 00000000-00006676.00000002.319232.007B0000.00000004.mdmp, 00000000-00006676.00000003.319323.007B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006676.00000000.315390.007B0000.00000004.mdmp, 00000000-00006676.00000000.315390.023D0000.00000004.mdmp, 00000000-00006676.00000001.317311.007B0000.00000004.mdmp, 00000000-00006676.00000001.317311.023D0000.00000004.mdmp, 00000000-00006676.00000002.319232.007B0000.00000004.mdmp, 00000000-00006676.00000002.319232.023D0000.00000004.mdmp, 00000000-00006676.00000003.319323.007B0000.00000004.mdmp, 00000000-00006676.00000003.319323.023D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006676.00000000.315390.007B0000.00000004.mdmp, 00000000-00006676.00000000.315390.023D0000.00000004.mdmp, 00000000-00006676.00000001.317311.007B0000.00000004.mdmp, 00000000-00006676.00000001.317311.023D0000.00000004.mdmp, 00000000-00006676.00000002.319232.007B0000.00000004.mdmp, 00000000-00006676.00000002.319232.023D0000.00000004.mdmp, 00000000-00006676.00000003.319323.007B0000.00000004.mdmp, 00000000-00006676.00000003.319323.023D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006676.00000000.315390.007B0000.00000004.mdmp, 00000000-00006676.00000001.317311.007B0000.00000004.mdmp, 00000000-00006676.00000002.319232.007B0000.00000004.mdmp, 00000000-00006676.00000003.319323.007B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006676.00000000.315390.007B0000.00000004.mdmp, 00000000-00006676.00000001.317311.007B0000.00000004.mdmp, 00000000-00006676.00000002.319232.007B0000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006676.00000003.319323.007B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007436.00000000.317640.005A0000.00000004.mdmp, 00000000-00007436.00000000.317640.02050000.00000004.mdmp, 00000000-00007436.00000000.317640.02580000.00000004.mdmp, 00000000-00007436.00000001.318586.005A0000.00000004.mdmp, 00000000-00007436.00000001.318586.02580000.00000004.mdmp, 00000000-00007436.00000001.318586.040FF000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007436.00000000.317640.005A0000.00000004.mdmp, 00000000-00007436.00000000.317640.02050000.00000004.mdmp, 00000000-00007436.00000000.317640.02580000.00000004.mdmp, 00000000-00007436.00000001.318586.005A0000.00000004.mdmp, 00000000-00007436.00000001.318586.02580000.00000004.mdmp, 00000000-00007436.00000001.318586.040FF000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007436.00000000.317640.005A0000.00000004.mdmp, 00000000-00007436.00000001.318586.005A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007436.00000001.318586.040FF000.00000004.mdmp")5a:T46a,Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; Source: "00000000-00006676.00000002.319232.73A9D000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00007436.00000000.317640.50280000.00000002.mdmp")5b:T453,"Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\NSR5F4C.TMP\IMAGINE64.EXE"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\IMAGINE\IMAGINE64.EXE"; Value: "") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Imagine64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Imagine64.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\IMAGINE\IMAGINE64.EXE"; Value: "")5c:T430b,"Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "AA190000000000000400040001001A020200000000B31C0200F76A010152B6010212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800104C8E02112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C021F6C76022018F200213AC30121777A00223BED0122A7730123116E01237AF80123ABE90123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F39D5002F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E3383003E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D02435EBA0143AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004C9E02024CC84B014D3ED9014E50C2014F14C2004FA53302508F00025276930253467301536A3A02538AAD015408340254302F0254B7DC0054DFE20155DB8C0155E6E101560A850057426B01577AF801578A1B0257AD120158021202589E270258BB5C025953940059C43C025A0189025A0289025A0A83025A2C80015AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063EC740263FD310264054E0264C9260164D4190164F42B0265A69E0065C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F0178159600785DD30179F99C027A5B7C027C82C9017CBAFC017D904A017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA00800184028106950081B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE01867B060186ECB6018754990287D5140287DE830087F0250187FC380288818702890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CDFD0193CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0197F6C40098C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A3E8DD01A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6E9B300A736A800A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC79D901AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BC6EB400BCD22A01BD388F00BEAF8A02BF674602BFDC4602C0079A00C03A8E02C046AD00C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C561EA01C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CF74AA00CFF36501D0175600D0B00802D1D2A700D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D3E88D00D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F1FC6000F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F62D3102F6F12B02F7125E00F7D36F00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FDDFE501FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023800060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0261367A0263CB2E0269B992026A23E20170FC8802786C6D0279DE98027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A6749502AFA32E02B0D58102B5235202B6F13B02B7F15002BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F7CC9002FC998D020600400100001ED770014B11B4006041AE00682C9000A5ADCF00CE99E0010100420100009E1E9001010043010000C0EC7C0000") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "DISPLAYNAME"; Value: "Imagine") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "DISPLAYICON"; Value: ""%LOCALAPPDATA%\Imagine\Imagine64.exe"") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "PUBLISHER"; Value: "Sejin Chun") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "DISPLAYVERSION"; Value: "2.8.0") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "ESTIMATEDSIZE"; Value: "1E13000000") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "HELPLINK"; Value: "http://www.nyam.pe.kr") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "URLINFOABOUT"; Value: "http://www.nyam.pe.kr") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "INSTALLLOCATION"; Value: "%LOCALAPPDATA%\Imagine") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "INSTALLSOURCE"; Value: "43003A00000000") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "NOMODIFY"; Value: "0100000000") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "NOREPAIR"; Value: "0100000000") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "UNINSTALLSTRING"; Value: ""%LOCALAPPDATA%\Imagine\Uninstall.exe" /CurrentUser") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "QUIETUNINSTALLSTRING"; Value: ""%LOCALAPPDATA%\Imagine\Uninstall.exe" /CurrentUser /S") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IMAGINE"; Key: "COMMENTS"; Value: "Image & Animation Viewer") "Imagine_2.8.0_x64_Unicode.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\IMAGINE\IMAGINE64.EXE"; Value: ""�'*") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "A91900000000000004000400010019020200000000B31C0200F76A010152B6010212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800104C8E02112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C021F6C76022018F200213AC30121777A00223BED0122A7730123116E01237AF80123ABE90123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F39D5002F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E3383003E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D02435EBA0143AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004C9E02024CC84B014D3ED9014E50C2014F14C2004FA53302508F00025276930253467301536A3A02538AAD015408340254302F0254B7DC0054DFE20155DB8C0155E6E101560A850057426B01577AF801578A1B0257AD120158021202589E270258BB5C025953940059C43C025A0189025A0289025A0A83025A2C80015AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063EC740263FD310264054E0264C9260164D4190164F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F0178159600785DD30179F99C027A5B7C027C82C9017CBAFC017D904A017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA00800184028106950081B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE01867B060186ECB6018754990287D5140287DE830087F0250187FC380288818702890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CDFD0193CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0197F6C40098C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A3E8DD01A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6E9B300A736A800A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC79D901AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BC6EB400BCD22A01BD388F00BEAF8A02BF674602BFDC4602C0079A00C03A8E02C046AD00C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C561EA01C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CF74AA00CFF36501D0175600D0B00802D1D2A700D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D3E88D00D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F1FC6000F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F62D3102F6F12B02F7125E00F7D36F00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FDDFE501FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023800060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0261367A0263CB2E0269B992026A23E20170FC8802786C6D0279DE98027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A6749502AFA32E02B0D58102B5235202B6F13B02B7F15002BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F7CC9002FC998D020600400100001ED770014B11B4006041AE00682C9000A5ADCF00CE99E0010100420100009E1E9001010043010000C0EC7C0000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\IMAGINE\IMAGINE64.EXE"; Value: "C1789A32826DDD010000000000000000000000000200000000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "GLOBALASSOCCHANGEDCOUNTER"; Value: "2F00000000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "GLOBALASSOCCHANGEDCOUNTER"; Value: "3000000000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "2B07000000000000040004000102080000000000190000000D787900010000002FD60F02010000006B507E0015000000795344020500000087DE830059000000A19F5E0001000000F062570201000000FED37A0004000100000041000000276B69012800000056737D00060000006B507E0006000000E6C5310002000400000001000000C49B7B0201000000EFBA8302020065000000FE130000E6C5310011000000F0E0B60001006800000001000000BC6EB40000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F00000000200000000000000049A8A801010203005C4614A6000000000F00000000000000D1A8A8010102030064B65611000000006800000000000000D1A8A80101000400FB3B54EB000000002F00000000000000C25CAB0101000200FECB062F00000000010000003D0F000023ACAD0102020400546DD0B4000000000100000085000000AFFBB9010100008055161AFB0000000001000000F93A00002B7ABA010202070017EB54670000000002000000050000004428C30101000080469996A2000000001D000000130400004428C30103000040EFD5A1DB0000000003000000450000004428C30104000100541F4AF4000000000F000000000000006597C90101020080EB47F5D000000000010000008D0000009F49DD010100008045734BE10000000002000000000000004959DD0101000400F34A296B0000000002000000A10200006A44DF010100008054528C5D00000000010000006101000081F7E10104000100C177129C00000000470000002000000081F7E101047F02002AF214C20000000008000000D0000000EC9BE501010000806E4C67B60000000001000000000000000C84EA010102010077F457460000000001000000160000008C5FF20101000400EA4046AF0000000003000000A10000003D4A060201000080C39240F0000000000100000013000000564A0602017F0080784A674B00000000010000004C000000BFDE08020100008065B49D6B0000000009000000B00000005F37110201000080856D77FF0000000004000000A30200006D38160201020080738B74C70000000001000000B4000000A4102702017F0080260FB9F900000000100000001C010000BCF4300201000080BE94981800000000010000006E0200006C97340201000080EE1839B90000000005000000000000009A483902010001006D537548000000000100000000000000B9BE4502010000808712A9830000000001000000E900000077384602017F0500101E3EA3000000000100000001000000D60F470201000080F82C30D1000000000100000001000000FDBE49020100008003520DB6000000000100000074050000487C4D0201000080127A123700000000640000000D00000093FE59020100010098FBB9D6000000000200000001000000477F610204000100DFB5D96E0000000001000000000000009E26640201010080C0A211130000000001000000000000005792640201000080FD2998950000000001000000DA020000FF40890201000080252A7840000000004800000014000000FF4089020300004026CCD6550000000018000000000000004614940201000080682B516C0000000001000000C42B000000") "Imagine64.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\IMAGINE\IMAGINE64.EXE"; Value: "87169832826DDD010000000000000000000000000200000000")5d:T537,"System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse258E.tmp\System.dll]- [targetUID: 00000000-00006676] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nse258E.tmp\nsDialogs.dll]- [targetUID: 00000000-00006676] "UserInfo.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse258E.tmp\UserInfo.dll]- [targetUID: 00000000-00006676] "Imagine.wdx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wdx64]- [targetUID: 00000000-00006676] "Imagine.wcx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wcx64]- [targetUID: 00000000-00006676] "Imagine.wlx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wlx64]- [targetUID: 00000000-00006676] "Imagine64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine64.dll]- [targetUID: 00000000-00000532] "Imagine64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine64.exe]- [targetUID: 00000000-00007436]5e:Tbfb,Dropped file: "Imagine64.dll" - Location: [%LOCALAPPDATA%\Imagine\Imagine64.dll]- [targetUID: 00000000-00000532] Dropped file: "Uninstall.exe" - Location: [%LOCALAPPDATA%\Imagine\Uninstall.exe]- [targetUID: 00000000-00006676] Dropped file: "Imagine64.exe" - Location: [%LOCALAPPDATA%\Imagine\Imagine64.exe]- [targetUID: 00000000-00007436] Dropped file: "Imagine.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine.lnk]- [targetUID: 00000000-00006676] Dropped file: "Uninstall.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Uninstall.lnk]- [targetUID: 00000000-00006676] Dropped file: "Imagine Help.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Imagine Help.lnk]- [targetUID: 00000000-00006676] Dropped file: "Readme.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Imagine\Readme.lnk]- [targetUID: 00000000-00006676] Dropped file: "PlugInst.inf" - Location: [%LOCALAPPDATA%\Imagine\PlugInst.inf]- [targetUID: 00000000-00006676] Dropped file: "Whatsnew.txt" - Location: [%LOCALAPPDATA%\Imagine\Whatsnew.txt]- [targetUID: 00000000-00006676] Dropped file: "Ukrainian.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Ukrainian.lng]- [targetUID: 00000000-00006676] Dropped file: "Romanian.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Romanian.lng]- [targetUID: 00000000-00006676] Dropped file: "Polish.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Polish.lng]- [targetUID: 00000000-00006676] Dropped file: "Japanese.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Japanese.lng]- [targetUID: 00000000-00006676] Dropped file: "SimplifiedChinese.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\SimplifiedChinese.lng]- [targetUID: 00000000-00006676] Dropped file: "Spanish.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Spanish.lng]- [targetUID: 00000000-00006676] Dropped file: "French.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\French.lng]- [targetUID: 00000000-00006676] Dropped file: "Dutch.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Dutch.lng]- [targetUID: 00000000-00006676] Dropped file: "Slovenian.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Slovenian.lng]- [targetUID: 00000000-00006676] Dropped file: "Imagine.ini" - Location: [%LOCALAPPDATA%\Imagine\Imagine.ini]- [targetUID: 00000000-00000532] Dropped file: "dir.txt" - Location: [%LOCALAPPDATA%\Imagine\Plugin\dir.txt]- [targetUID: 00000000-00006676] Dropped file: "Imagine.chm" - Location: [%LOCALAPPDATA%\Imagine\Imagine.chm]- [targetUID: 00000000-00006676] Dropped file: "Russian.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Russian.lng]- [targetUID: 00000000-00006676] Dropped file: "Czech.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Czech.lng]- [targetUID: 00000000-00000532] Dropped file: "Danish.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Danish.lng]- [targetUID: 00000000-00006676] Dropped file: "Turkish.lng" - Location: [%LOCALAPPDATA%\Imagine\Language\Turkish.lng]- [targetUID: 00000000-00006676]5f:Taae,Found string "MulDiv" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "DeleteFileW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "FindNextFileW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "ReadFile" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "MultiByteToWideChar" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "lstrlenA" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "WideCharToMultiByte" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNEL32.DLL) Found string "FreeLibrary" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "SearchPathW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL) Found string "GetShortPathNameW" (Source: Imagine_2.8.0_x64_Unicode.exe, API is part of module: KERNELBASE.DLL)60:T64c,"Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "Imagine_2.8.0_x64_Unicode.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "Imagine64.exe" reads file "C:\Users\desktop.ini" "Imagine64.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "Imagine64.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "Imagine64.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "Imagine64.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "Imagine64.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "Imagine64.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "Imagine64.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"61:T967,"Imagine64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine64.dll]- [targetUID: 00000000-00000532] "Uninstall.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%LOCALAPPDATA%\Imagine\Uninstall.exe]- [targetUID: 00000000-00006676] "Imagine64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine64.exe]- [targetUID: 00000000-00007436] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse258E.tmp\System.dll]- [targetUID: 00000000-00006676] "nsDialogs.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nse258E.tmp\nsDialogs.dll]- [targetUID: 00000000-00006676] "UserInfo.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nse258E.tmp\UserInfo.dll]- [targetUID: 00000000-00006676] "Imagine.wdx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wdx64]- [targetUID: 00000000-00006676] "Imagine.wcx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wcx64]- [targetUID: 00000000-00006676] "Imagine.wlx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine.wlx64]- [targetUID: 00000000-00006676] "Imagine64.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine64.dll]- [targetUID: 00000000-00000532] "Imagine64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- Location: [%TEMP%\nsr5F4C.tmp\Imagine64.exe]- [targetUID: 00000000-00007436] "Imagine.wdx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine.wdx64]- [targetUID: 00000000-00006676] "Imagine.wcx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine.wcx64]- [targetUID: 00000000-00006676] "Imagine.wlx64" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 5 sections"- Location: [%LOCALAPPDATA%\Imagine\Imagine.wlx64]- [targetUID: 00000000-00006676]62:T16b6,"Imagine_2.8.0_x64_Unicode.exe" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nse258E.tmp\UserInfo.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nse258E.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nse258E.tmp\nsDialogs.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 7680 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wcx64": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 14336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wdx64": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 5632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wlx64": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 7680 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine.wcx64": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 14336 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine.wdx64": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 5632 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine.wlx64": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 15360 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Imagine_2.8.0_x64_Unicode.exe" wrote 41472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Imagine\Uninstall.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...63:Tc7d,"Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsj255D.tmp" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nse258E.tmp" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.chm" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wcx64" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wdx64" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine.wlx64" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.dll" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.exe" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Arabic.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Czech.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Danish.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Dutch.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\French.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\German.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Italiano.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Japanese.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Korean.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Polish.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Portuguese (Brazil).lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Portuguese (Portugal).lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Romanian.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Russian.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\SimplifiedChinese.lng" with delete access "Imagine_2.8.0_x64_Unicode.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Language\Slovenian.lng" with delete access64:T578,"Imagine_2.8.0_x64_Unicode.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.exe" (Handle: 152) "Imagine_2.8.0_x64_Unicode.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\nsr5F4C.tmp\Imagine64.exe" (Handle: 152) "Imagine_2.8.0_x64_Unicode.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Handle: 1088) "Imagine_2.8.0_x64_Unicode.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Handle: 1088) "Imagine_2.8.0_x64_Unicode.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Handle: 1112) "Imagine_2.8.0_x64_Unicode.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Handle: 1112) "Imagine64.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Handle: 1472) "Imagine64.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Handle: 1472) "Imagine64.exe" wrote 000011C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Handle: 1552) "Imagine64.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Imagine\Imagine64.exe" (Handle: 1552)65:T1124,Spawned process "Imagine_2.8.0_x64_Unicode.exe" (UID: 00000000-00006676) Spawned process "Imagine64.exe" with commandline "/__terminateprograms" (UID: 00000000-00003480) Spawned process "Imagine64.exe" with commandline "/pref:106" (UID: 00000000-00004044) Spawned process "Imagine64.exe" with commandline "/pref:121" (UID: 00000000-00007436) Spawned process "Imagine64.exe" with commandline "/__dissocext:"Windows Animated Cursor" /__dissocext:"DeluxePaint Animation" /__dissocext:"Windows or OS/2 Bitmap" /__dissocext:"CorelDRAW Drawing" /__dissocext:"Windows Clipboard" /__dissocext:"Windows Cursor" /__dissocext:"Dr. Halo Clipping Image" /__dissocext:"DICOM Image" /__dissocext:"ZSoft Multi-Page Paintbrush" /__dissocext:"DirectDraw Surface" /__dissocext:"Digital Picture Exchange" /__dissocext:"Windows Enhanced Metafile" /__dissocext:"Farbfeld" /__dissocext:"Autodesk Flic Animation" /__dissocext:"Graphics Interchange Format" /__dissocext:"Radiance High Dynamic Range Image" /__dissocext:"Icon Library" /__dissocext:"Apple Icon Image Format" /__dissocext:"Windows Icon" /__dissocext:"ivory Sprite Animation" /__dissocext:"JPEG Network Graphics" /__dissocext:"JPEG - JFIF Compliant" /__dissocext:"Krita" /__dissocext:"IFF Interleaved Bitmap" /__dissocext:"LCD Bitmap" /__dissocext:"Apple Macintosh MacPaint" /__dissocext:"Psion Series 5 Bitmap" /__dissocext:"Multiple-image Network Graphics" /__dissocext:"OpenRaster" /__dissocext:"Portable Arbitrary Map" /__dissocext:"Portable Bitmap" /__dissocext:"Kodak PhotoCD" /__dissocext:"ZSoft PC Paintbrush" /__dissocext:"Paint.NET Image" /__dissocext:"Portable Floatmap" /__dissocext:"Portable Graymap" /__dissocext:"Softimage" /__dissocext:"Dr. Halo Image" /__dissocext:"Autodesk Animator PIC" /__dissocext:"Portable Network Graphics" /__dissocext:"Portable Pixelmap" /__dissocext:"Adobe Photoshop" /__dissocext:"Paint Shop Pro Image" /__dissocext:"Quite OK Image" /__dissocext:"Sun Raster Image" /__dissocext:"Wavefront Raster Image" /__dissocext:"Utah RLE" /__dissocext:"Silicon Graphics Image" /__dissocext:"Pro Motion Animation" /__dissocext:"Truevision Targa" /__dissocext:"Tagged Image File Format" /__dissocext:"Wireless Bitmap" /__dissocext:"Windows Metafile" /__dissocext:"WordPerfect Graphics" /__dissocext:"X10/X11 Bitmap" /__dissocext:"GIMP Bitmap" /__dissocext:"X11 Pixmap"" (UID: 00000000-00002868) Spawned process "Imagine64.exe" with commandline "/__dissocext:"Windows Animated Cursor" /__dissocext:"DeluxePaint Animation" /__dissocext:"Windows or OS/2 Bitmap" /__dissocext:"CorelDRAW Drawing" /__dissocext:"Windows Clipboard" /__dissocext:"Windows Cursor" /__dissocext:"Dr. Halo Clipping Image" /__dissocext:"DICOM Image" /__dissocext:"ZSoft Multi-Page Paintbrush" /__dissocext:"DirectDraw Surface" /__dissocext:"Digital Picture Exchange" /__dissocext:"Windows Enhanced Metafile" /__dissocext:"Farbfeld" /__dissocext:"Autodesk Flic Animation" /__dissocext:"Graphics Interchange Format" /__dissocext:"Radiance High Dynamic Range Image" /__dissocext:"Icon Library" /__dissocext:"Apple Icon Image Format" /__dissocext:"Windows Icon" /__dissocext:"ivory Sprite Animation" /__dissocext:"JPEG Network Graphics" /__dissocext:"JPEG - JFIF Compliant" /__dissocext:"Krita" /__dissocext:"IFF Interleaved Bitmap" /__dissocext:"LCD Bitmap" /__dissocext:"Apple Macintosh MacPaint" /__dissocext:"Psion Series 5 Bitmap" /__dissocext:"Multiple-image Network Graphics" /__dissocext:"OpenRaster" /__dissocext:"Portable Arbitrary Map" /__dissocext:"Portable Bitmap" /__dissocext:"Kodak PhotoCD" /__dissocext:"ZSoft PC Paintbrush" /__dissocext:"Paint.NET Image" /__dissocext:"Portable Floatmap" /__dissocext:"Portable Graymap" /__dissocext:"Softimage" /__dissocext:"Dr. Halo Image" /__dissocext:"Autodesk Animator PIC" /__dissocext:"Portable Network Graphics" /__dissocext:"Portable Pixelmap" /__dissocext:"Adobe Photoshop" /__dissocext:"Paint Shop Pro Image" /__dissocext:"Quite OK Image" /__dissocext:"Sun Raster Image" /__dissocext:"Wavefront Raster Image" /__dissocext:"Utah RLE" /__dissocext:"Silicon Graphics Image" /__dissocext:"Pro Motion Animation" /__dissocext:"Truevision Targa" /__dissocext:"Tagged Image File Format" /__dissocext:"Wireless Bitmap" /__dissocext:"Windows Metafile" /__dissocext:"WordPerfect Graphics" /__dissocext:"X10/X11 Bitmap" /__dissocext:"GIMP Bitmap" /__dissocext:"X11 Pixmap"" (UID: 00000000-00000532)66:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAczMzMzMzMzMwAAAAAAAAAH+Li4uLi4uLMwAAAAAAAAB/uLi4uLi4uDMwAAAAAAAAf4uLi4uLi4szMwAAAAAAAH+4uLi4uLi4MzMwAAAAAAB/i4uLi4uLizMzMAAAAAAAf7i4uLi4uLgzMzAAAAAAAH+Li4uLi4uLMzMwAAAAAAB/uLi4uLi4uDMzMAAAAAAAf4uLi4uLi4szMzAAAAAAAHMzMzMzMzMzAzMwAAAAAAczMz9/iIh3DzAzMAAAAABzjzM/f4iIhw/zAzAAAAAHOPjzN/iIiIhw8zAwAAAAc4+PjzeAAAAHcDMzAAAAAAP4+PMAB4iIgAAAAzAAAAAAP480R0RV9VV3AAAzAAAAAAPzDMRM3VXVgREAAwAAAAAAMARLNFWzVRGXAAAwAAAAAAAMzEzd1d2zEQAAAAAAAAAAEQxBRNWZkZkAAAAAAAAAAJkRl8xExJEzAAAAAAAAAAARsxFEs0SzuwAAAAAAAAAAmZGZzMTMswAAAAAAAAAAAACRAADEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////wAAf/8AAD//AAAf/wAAD/8AAAf/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/gAAA/wAAAP4AAAD8AAAA/gIAOP8AABx/iAAOf9gADj/4AA//8gAP//AAD//wAA//8AA///zz///////////////////////w==67:T798,/__dissocext:"Windows Animated Cursor" /__dissocext:"DeluxePaint Animation" /__dissocext:"Windows or OS/2 Bitmap" /__dissocext:"CorelDRAW Drawing" /__dissocext:"Windows Clipboard" /__dissocext:"Windows Cursor" /__dissocext:"Dr. Halo Clipping Image" /__dissocext:"DICOM Image" /__dissocext:"ZSoft Multi-Page Paintbrush" /__dissocext:"DirectDraw Surface" /__dissocext:"Digital Picture Exchange" /__dissocext:"Windows Enhanced Metafile" /__dissocext:"Farbfeld" /__dissocext:"Autodesk Flic Animation" /__dissocext:"Graphics Interchange Format" /__dissocext:"Radiance High Dynamic Range Image" /__dissocext:"Icon Library" /__dissocext:"Apple Icon Image Format" /__dissocext:"Windows Icon" /__dissocext:"ivory Sprite Animation" /__dissocext:"JPEG Network Graphics" /__dissocext:"JPEG - JFIF Compliant" /__dissocext:"Krita" /__dissocext:"IFF Interleaved Bitmap" /__dissocext:"LCD Bitmap" /__dissocext:"Apple Macintosh MacPaint" /__dissocext:"Psion Series 5 Bitmap" /__dissocext:"Multiple-image Network Graphics" /__dissocext:"OpenRaster" /__dissocext:"Portable Arbitrary Map" /__dissocext:"Portable Bitmap" /__dissocext:"Kodak PhotoCD" /__dissocext:"ZSoft PC Paintbrush" /__dissocext:"Paint.NET Image" /__dissocext:"Portable Floatmap" /__dissocext:"Portable Graymap" /__dissocext:"Softimage" /__dissocext:"Dr. Halo Image" /__dissocext:"Autodesk Animator PIC" /__dissocext:"Portable Network Graphics" /__dissocext:"Portable Pixelmap" /__dissocext:"Adobe Photoshop" /__dissocext:"Paint Shop Pro Image" /__dissocext:"Quite OK Image" /__dissocext:"Sun Raster Image" /__dissocext:"Wavefront Raster Image" /__dissocext:"Utah RLE" /__dissocext:"Silicon Graphics Image" /__dissocext:"Pro Motion Animation" /__dissocext:"Truevision Targa" /__dissocext:"Tagged Image File Format" /__dissocext:"Wireless Bitmap" /__dissocext:"Windows Metafile" /__dissocext:"WordPerfect Graphics" /__dissocext:"X10/X11 Bitmap" /__dissocext:"GIMP Bitmap" /__dissocext:"X11 Pixmap"68:T798,/__dissocext:"Windows Animated Cursor" /__dissocext:"DeluxePaint Animation" /__dissocext:"Windows or OS/2 Bitmap" /__dissocext:"CorelDRAW Drawing" /__dissocext:"Windows Clipboard" /__dissocext:"Windows Cursor" /__dissocext:"Dr. Halo Clipping Image" /__dissocext:"DICOM Image" /__dissocext:"ZSoft Multi-Page Paintbrush" /__dissocext:"DirectDraw Surface" /__dissocext:"Digital Picture Exchange" /__dissocext:"Windows Enhanced Metafile" /__dissocext:"Farbfeld" /__dissocext:"Autodesk Flic Animation" /__dissocext:"Graphics Interchange Format" /__dissocext:"Radiance High Dynamic Range Image" /__dissocext:"Icon Library" /__dissocext:"Apple Icon Image Format" /__dissocext:"Windows Icon" /__dissocext:"ivory Sprite Animation" /__dissocext:"JPEG Network Graphics" /__dissocext:"JPEG - JFIF Compliant" /__dissocext:"Krita" /__dissocext:"IFF Interleaved Bitmap" /__dissocext:"LCD Bitmap" /__dissocext:"Apple Macintosh MacPaint" /__dissocext:"Psion Series 5 Bitmap" /__dissocext:"Multiple-image Network Graphics" /__dissocext:"OpenRaster" /__dissocext:"Portable Arbitrary Map" /__dissocext:"Portable Bitmap" /__dissocext:"Kodak PhotoCD" /__dissocext:"ZSoft PC Paintbrush" /__dissocext:"Paint.NET Image" /__dissocext:"Portable Floatmap" /__dissocext:"Portable Graymap" /__dissocext:"Softimage" /__dissocext:"Dr. Halo Image" /__dissocext:"Autodesk Animator PIC" /__dissocext:"Portable Network Graphics" /__dissocext:"Portable Pixelmap" /__dissocext:"Adobe Photoshop" /__dissocext:"Paint Shop Pro Image" /__dissocext:"Quite OK Image" /__dissocext:"Sun Raster Image" /__dissocext:"Wavefront Raster Image" /__dissocext:"Utah RLE" /__dissocext:"Silicon Graphics Image" /__dissocext:"Pro Motion Animation" /__dissocext:"Truevision Targa" /__dissocext:"Tagged Image File Format" /__dissocext:"Wireless Bitmap" /__dissocext:"Windows Metafile" /__dissocext:"WordPerfect Graphics" /__dissocext:"X10/X11 Bitmap" /__dissocext:"GIMP Bitmap" /__dissocext:"X11 Pixmap"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":80,"unified_at_epoch_ms":1793923500982,"unified_at":"2026-11-06T00:05:00.982Z","metadata":{"hashes":{"sha256":"4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","sha1":"cd44b15700403db3dabe777d6704a0e14c07250e","md5":"eafbb0340439f97b5d2f3e0bec5d61b7","sha512":"0457f6e5620cc590c1f5eec40370b33ebc0124eaf4b8a41462deea4410487e782b090f04f3938c627ea1af6c1124318584619a9c5cdc8789717852f6f4c3c04e","ssdeep":"24576:72ncurpgrFrf3A5ScWoy1M3tgwIfgw4iZjRxMGza+b93pmvSv+sW+AVCt:Kn9mJAwtFyK7dMgav6+sqVQ","ssdeep_chunks":["24576:72ncurp","24576:2ncurpg","24576:ncurpgr","24576:curpgrF","24576:urpgrFr","24576:rpgrFrf","24576:pgrFrf3","24576:grFrf3A","24576:rFrf3A5","24576:Frf3A5S","24576:rf3A5Sc","24576:f3A5ScW","24576:3A5ScWo","24576:A5ScWoy","24576:5ScWoy1","24576:ScWoy1M","24576:cWoy1M3","24576:Woy1M3t","24576:oy1M3tg","24576:y1M3tgw","24576:1M3tgwI","24576:M3tgwIf","24576:3tgwIfg","24576:tgwIfgw","24576:gwIfgw4","24576:wIfgw4i","24576:Ifgw4iZ","24576:fgw4iZj","24576:gw4iZjR","24576:w4iZjRx","24576:4iZjRxM","24576:iZjRxMG","24576:ZjRxMGz","24576:jRxMGza","24576:RxMGza+","24576:xMGza+b","24576:MGza+b9","24576:Gza+b93","24576:za+b93p","24576:a+b93pm","24576:+b93pmv","24576:b93pmvS","24576:93pmvSv","24576:3pmvSv+","24576:pmvSv+s","24576:mvSv+sW","24576:vSv+sW+","24576:Sv+sW+A","24576:v+sW+AV","24576:+sW+AVC","24576:sW+AVCt","49152:72ncurp","49152:2ncurpg","49152:ncurpgr","49152:curpgrF","49152:urpgrFr","49152:rpgrFrf","49152:pgrFrf3","49152:grFrf3A","49152:rFrf3A5","49152:Frf3A5S","49152:rf3A5Sc","49152:f3A5ScW","49152:3A5ScWo","49152:A5ScWoy","49152:5ScWoy1","49152:ScWoy1M","49152:cWoy1M3","49152:Woy1M3t","49152:oy1M3tg","49152:y1M3tgw","49152:1M3tgwI","49152:M3tgwIf","49152:3tgwIfg","49152:tgwIfgw","49152:gwIfgw4","49152:wIfgw4i","49152:Ifgw4iZ","49152:fgw4iZj","49152:gw4iZjR","49152:w4iZjRx","49152:4iZjRxM","49152:iZjRxMG","49152:ZjRxMGz","49152:jRxMGza","49152:RxMGza+","49152:xMGza+b","49152:MGza+b9","49152:Gza+b93","49152:za+b93p","49152:a+b93pm","49152:+b93pmv","49152:b93pmvS","49152:93pmvSv","49152:3pmvSv+","49152:pmvSv+s","49152:mvSv+sW","49152:vSv+sW+","49152:Sv+sW+A","49152:v+sW+AV","49152:+sW+AVC","49152:sW+AVCt","24576:Kn9mJAw","24576:n9mJAwt","24576:9mJAwtF","24576:mJAwtFy","24576:JAwtFyK","24576:AwtFyK7","24576:wtFyK7d","24576:tFyK7dM","24576:FyK7dMg","24576:yK7dMga","24576:K7dMgav","24576:7dMgav6","24576:dMgav6+","24576:Mgav6+s","24576:gav6+sq","24576:av6+sqV","24576:v6+sqVQ"],"imphash":"1f23f452093b5c1ff091a2f9fb4fa3e9","pehash":"1e59ce42657da76f3d3fe3f510b57471a19790e9"},"file_info":{"file_name":"Imagine_2.8.0_x64_Unicode.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":1851810,"entropy":8,"compile_timestamp":"2017-08-01T00:33:59","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793923311000,"last_seen":1793923311000,"last_multi_scan":1793923311000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":25553,"raw_size":25600},{"name":".rdata","virtual_address":"0x8000","virtual_size":5006,"raw_size":5120},{"name":".data","virtual_address":"0xa000","virtual_size":131928,"raw_size":1536},{"name":".ndata","virtual_address":"0x2b000","virtual_size":172032},{"name":".rsrc","virtual_address":"0x55000","virtual_size":7944,"raw_size":8192}],"section_names":[".text",".rdata",".data",".ndata",".rsrc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["nsis"]}]},"detections":{"summary":{"verdict":"malicious","score":80,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":78},"sandbox_signatures":{"informative_count":183,"suspicious_count":15,"malicious_count":4,"total":202},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware_100.0","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"suspicious","value":"Tries to obtain the highest possible privilege level without UAC dialog"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"System Security","name":"Tries to obtain the highest possible privilege level without UAC dialog","description":"$36","origin":"sample.bin","mitre_attack_id":"T1548.002","id":"string-31","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$37","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"cx.br\", Pattern match: \"http://nsis.sf.net/nsis_error\", Pattern match: \"http://schemas.microsoft.com/smi/2005/windowssettings\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"sample.bin\"), Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"file/memory contains long string with (Indicator: \"OpenThread\"; File: \"UserInfo.dll\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00006676.00000000.315390.0040A000.00000004.mdmp, 00000000-00006676.00000001.317311.0040A000.00000004.mdmp, 00000000-00006676.00000002.319232.0040A000.00000004.mdmp, 00000000-00006676.00000003.319323.0040A000.00000004.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"Imagine64.exe\" called \"FindResourceW\" with parameter \"185\" - (UID: 00000000-00003480)\n \"Imagine64.exe\" called \"FindResourceW\" with parameter \"185\" - (UID: 00000000-00004044)\n \"Imagine64.exe\" called \"FindResourceW\" with parameter \"185\" - (UID: 00000000-00007436)\n \"Imagine64.exe\" called \"FindResourceW\" with parameter \"185\" - (UID: 00000000-00002868)\n \"Imagine64.exe\" called \"FindResourceW\" with parameter \"185\" - (UID: 00000000-00000532)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Imagine64.exe\" called \"LoadResource with parameter {'hModule': '1342177280', 'hResInfo': '1346187512'}\" (UID: 00000000-00003480)\n \"Imagine64.exe\" called \"LoadResource with parameter {'hModule': '1342177280', 'hResInfo': '1346187512'}\" (UID: 00000000-00004044)\n \"Imagine64.exe\" called \"LoadResource with parameter {'hModule': '1342177280', 'hResInfo': '1346187512'}\" (UID: 00000000-00007436)\n \"Imagine64.exe\" called \"LoadResource with parameter {'hModule': '1342177280', 'hResInfo': '1346187512'}\" (UID: 00000000-00002868)\n \"Imagine64.exe\" called \"LoadResource with parameter {'hModule': '1342177280', 'hResInfo': '1346187512'}\" (UID: 00000000-00000532)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nsr5F4C.tmp\\Language\\ (UID: 00000000-00006676)\n \"Imagine_2.8.0_x64_Unicode.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nsr5F4C.tmp\\Plugin\\ (UID: 00000000-00006676)\n \"Imagine_2.8.0_x64_Unicode.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nsr5F4C.tmp\\ (UID: 00000000-00006676)\n \"Imagine_2.8.0_x64_Unicode.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nse258E.tmp\\ (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"!\"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\"), Found string \"!\"#$%&'()*+\n-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006676.00000000.315390.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006676.00000001.317311.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006676.00000002.319232.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006676.00000003.319323.0040A000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Imagine_2.8.0_x64_Unicode.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Imagine_2.8.0_x64_Unicode.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"Imagine64.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Imagine64.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$38","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$39","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Imagine64.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006676.00000000.315390.007B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00000532.00000000.318547.00500000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00006676.00000000.315390.007B0000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00006676.00000000.315390.007B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99502","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"UserInfo.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Imagine\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00006676.00000000.315390.007B0000.00000004.mdmp, 00000000-00006676.00000001.317311.0040A000.00000004.mdmp, 00000000-00006676.00000001.317311.007B0000.00000004.mdmp, 00000000-00006676.00000002.319232.007B0000.00000004.mdmp, 00000000-00006676.00000003.319323.007D1000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006676.00000002.319232.73A9D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"EnumDateFormatsW\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"EnumTimeFormatsW\" (Indicator: \"EnumTimeFormats\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00007436.00000001.318586.02E00000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00006676)\n \"Imagine_2.8.0_x64_Unicode.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Imagine64.exe\" called \"EnumWindows\" with parameter \"1366032\" - (UID: 00000000-00004044)\n \"Imagine64.exe\" called \"EnumWindows\" with parameter \"48165840\" - (UID: 00000000-00007436)\n \"Imagine64.exe\" called \"EnumWindows\" with parameter \"47117264\" - (UID: 00000000-00007436)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$3d","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Imagine64.exe\" called \"GetActiveWindow\" (UID: 00000000-00004044)\n \"Imagine64.exe\" called \"GetActiveWindow\" (UID: 00000000-00007436)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Imagine64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Imagine64.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"FileTimeToLocalFileTime\"; File: \"Imagine.wcx64\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006676.00000002.319232.73A9D000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSR5F4C.TMP\\IMAGINE64.DLL\n %TEMP%\\NSE258E.TMP\\USERINFO.DLL\n %LOCALAPPDATA%\\IMAGINE\\IMAGINE64.DLL\n %TEMP%\\NSE258E.TMP\\SYSTEM.DLL\n %TEMP%\\NSE258E.TMP\\NSDIALOGS.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"Imagine_2.8.0_x64_Unicode.exe\" queried token user identity (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Imagine_2.8.0_x64_Unicode.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006676-00000C17-3145549907\n \"Imagine_2.8.0_x64_Unicode.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006676-00000C17-3145737622\n \"Imagine_2.8.0_x64_Unicode.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006676-00000C17-3145810309\n \"Imagine_2.8.0_x64_Unicode.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006676-00000C17-3145940823\n \"Imagine_2.8.0_x64_Unicode.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006676-00000C17-3146036775","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Imagine64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\IMAGINE\")\n \"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\IMAGINE\")\n \"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IMAGINE_2.8.0_X64_UNICODE.EXE\")\n \"Imagine64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IMAGINE64.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"Imagine64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"Imagine64.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006676.00000001.317311.02583000.00000002.mdmp, 00000000-00006676.00000002.319232.73A9D000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$40","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\nsr5F4C.tmp\\Imagine64.exe\" /__terminateprograms\" - (UID: 00000000-00006676)\n \"Imagine_2.8.0_x64_Unicode.exe\" called \"CreateProcessW\" with parameter \"%LOCALAPPDATA%\\Imagine\\Imagine64.exe /pref:106\" - (UID: 00000000-00006676)\n \"Imagine_2.8.0_x64_Unicode.exe\" called \"CreateProcessW\" with parameter \"%LOCALAPPDATA%\\Imagine\\Imagine64.exe /pref:121\" - (UID: 00000000-00006676)\n \"Imagine64.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Imagine\\Imagine64.exe\" /__dissocex%WINDIR%\\Animated Cursor\" /__dissocext:\"DeluxePaint Animation\" - (UID: 00000000-00007436)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$42","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$44","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$45","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Imagine_2.8.0_x64_Unicode.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Uninstall.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"zfrx94@mail.ru\"\n Pattern match: \"f9b2ldr96@2f9b2l.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: %s/%s\" (Indicator: \"user-agent: \"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$47","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Imagine_2.8.0_x64_Unicode.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73DA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Imagine_2.8.0_x64_Unicode.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 755A0000\n \"Imagine64.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 76B60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Imagine_2.8.0_x64_Unicode.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77560000\n \"Imagine64.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 773E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020429676fb7f0000@ntdll.dll\"\n \"220023000000000040429676fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$48","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$49","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Imagine64.exe\" (UID: 00000000-00003480) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Imagine64.exe\" (UID: 00000000-00003480) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"Imagine64.exe\" (UID: 00000000-00002868) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"Imagine64.exe\" (UID: 00000000-00002868) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Imagine64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Imagine64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Imagine64.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"Imagine64.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Imagine_2.8.0_x64_Unicode.exe\" searching for class \"#32770\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Imagine64.exe\" with commandline \"/__terminateprograms\" (UID: 00000000-00003480)\n Spawned process \"Imagine64.exe\" with commandline \"/pref:106\" (UID: 00000000-00004044)\n Spawned process \"Imagine64.exe\" with commandline \"/pref:121\" (UID: 00000000-00007436)\n Spawned process \"Imagine64.exe\" with commandline \"/__dissocext:\"Windows Animated Cursor\" /__dissocext:\"DeluxePaint ...\" (UID: 00000000-00002868), Spawned process \"Imagine64.exe\" with commandline \"/__dissocext:\"Windows Animated Cursor\" /__dissocext:\"DeluxePaint ...\" (UID: 00000000-00000532)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Imagine64.exe\" with commandline \"/__terminateprograms\" (UID: 00000000-00003480)\n Spawned process \"Imagine64.exe\" with commandline \"/pref:106\" (UID: 00000000-00004044)\n Spawned process \"Imagine64.exe\" with commandline \"/pref:121\" (UID: 00000000-00007436)\n Spawned process \"Imagine64.exe\" with commandline \"/__dissocext:\"Windows Animated Cursor\" /__dissocext:\"DeluxePaint ...\" (UID: 00000000-00002868), Spawned process \"Imagine64.exe\" with commandline \"/__dissocext:\"Windows Animated Cursor\" /__dissocext:\"DeluxePaint ...\" (UID: 00000000-00000532)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 811918)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Imagine_2.8.0_x64_Unicode.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Uninstall.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsDialogs.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"UserInfo.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Imagine_2.8.0_x64_Unicode.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nso257D.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Imagine_2.8.0_x64_Unicode.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Imagine64.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"PlugInst.inf\" has type \"ISO-8859 text with CRLF line terminators\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nso257D.tmp\" has type \"data\" - Location: [%TEMP%\\nso257D.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"Imagine64.dll\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections\"- Location: [%LOCALAPPDATA%\\Imagine\\Imagine64.dll]- [targetUID: 00000000-00000532]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nse258E.tmp\\System.dll]- [targetUID: 00000000-00006676]\n \"nsDialogs.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nse258E.tmp\\nsDialogs.dll]- [targetUID: 00000000-00006676]\n \"UserInfo.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nse258E.tmp\\UserInfo.dll]- [targetUID: 00000000-00006676]\n \"Imagine64.dll\" has type \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 6 sections\"- Location: [%TEMP%\\nsr5F4C.tmp\\Imagine64.dll]- [targetUID: 00000000-00000532]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Imagine_2.8.0_x64_Unicode.exe\" queries basic process information of the \"C:\\Imagine_2.8.0_x64_Unicode.exe\" (UID: 6676)\n \"Imagine_2.8.0_x64_Unicode.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsr5F4C.tmp\\Imagine64.exe\" (UID: 6676)\n \"Imagine_2.8.0_x64_Unicode.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Imagine\\Imagine64.exe\" (UID: 6676)\n \"Imagine64.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsr5F4C.tmp\\Imagine64.exe\" (UID: 3480)\n \"Imagine64.exe\" queries basic process information of the \"C:\\Windows\\System32\\sihost.exe\" (UID: 3480)\n \"Imagine64.exe\" queries basic process information of the \"C:\\Windows\\System32\\svchost.exe\" (UID: 3480)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Imagine_2.8.0_x64_Unicode.exe\" reads file \"c:\\imagine_2.8.0_x64_unicode.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Imagine_2.8.0_x64_Unicode.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nso257d.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetAddConnection3W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection3W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"ile System Bind Data\" (Indicator: \" bind \"; Source: \"00000000-00006676.00000002.319232.007B0000.00000004.mdmp, 00000000-00006676.00000003.319323.00821000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET %s HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00006676.00000002.319232.007B0000.00000004.mdmp, 00000000-00006676.00000003.319323.00821000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE1031FE7D0D2DC372E6807C848811]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007436.00000001.318586.040FF000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE46FE4D90CB29914CEA6C2F87728]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007436.00000001.318586.040FF000.00000004.mdmp\")\n Found string \"767a036-0d22-48aa-ba69-b619480f38cb@ncalrpc:\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007436.00000001.318586.040FF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007436.00000001.318586.040FF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"$57","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"GetComputerNameW\" (UID: 00000000-00006676)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$58","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"UserInfo.dll\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006676.00000000.315390.0040A000.00000004.mdmp, 00000000-00006676.00000001.317311.0040A000.00000004.mdmp, 00000000-00006676.00000002.319232.0040A000.00000004.mdmp, 00000000-00006676.00000003.319323.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006676.00000002.319232.73A41000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006676.00000002.319232.73A9D000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Imagine\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00006676.00000000.315390.007B0000.00000004.mdmp\n 00000000-00006676.00000001.317311.0040A000.00000004.mdmp\n 00000000-00006676.00000001.317311.007B0000.00000004.mdmp\n 00000000-00006676.00000002.319232.007B0000.00000004.mdmp\n 00000000-00006676.00000003.319323.007D1000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Radiopharmaceutical Route Code Sequence\" (Indicator: \"route\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found string \"Route of Admissions\" (Indicator: \"route\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found string \"Radiopharmaceutical Route\" (Indicator: \"route\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found string \"Contrast/Bolus Route\" (Indicator: \"route\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found string \"Contrast/Bolus Administration Route Sequence\" (Indicator: \"route\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$59","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Imagine_2.8.0_x64_Unicode.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\IMAGINE\\IMAGINE64.EXE\"; Value: \"\"�'*\")\n \"Imagine64.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\IMAGINE\\IMAGINE64.EXE\"; Value: \"C1789A32826DDD010000000000000000000000000200000000\")\n \"Imagine64.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\USERS\\HAPUBWS\\APPDATA\\LOCAL\\IMAGINE\\IMAGINE64.EXE\"; Value: \"87169832826DDD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Imagine_2.8.0_x64_Unicode.exe\" opened \"\\Device\\KsecDD\"\n \"Imagine64.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"Device\\HarddiskVolume3\\DosDevices\\C:\\??\\Volume{44294f7c-6083-41c6-8176-3c202d755616}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00002868.00000000.318545.0044C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00006676.00000002.319232.73A9D000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00006676.00000002.319232.73A9D000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006676.00000002.319232.73A9D000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007436.00000000.317640.50280000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$5d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5e","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Imagine_2.8.0_x64_Unicode.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"Imagine64.exe\" at 00000000-00007436-00000C15-3138760312","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"Imagine_2.8.0_x64_Unicode.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\IMAGINE\"; Key: \"DISPLAYICON\"; Value: \"\"%LOCALAPPDATA%\\Imagine\\Imagine64.exe\"\")\n \"Imagine_2.8.0_x64_Unicode.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\IMAGINE\"; Key: \"UNINSTALLSTRING\"; Value: \"\"%LOCALAPPDATA%\\Imagine\\Uninstall.exe\" /CurrentUser\")\n \"Imagine_2.8.0_x64_Unicode.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\IMAGINE\"; Key: \"QUIETUNINSTALLSTRING\"; Value: \"\"%LOCALAPPDATA%\\Imagine\\Uninstall.exe\" /CurrentUser /S\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"Imagine_2.8.0_x64_Unicode.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Imagine_2.8.0_x64_Unicode.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsr5F4C.tmp\\Imagine64.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\AppData\\Local\\Imagine\\Imagine64.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$60","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$61","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$62","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"ystem.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00007436.00000001.318586.02E00000.00000002.mdmp\")\n Found string \"System.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00007436.00000001.318586.06120000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-476","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$63","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"Imagine_2.8.0_x64_Unicode.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Imagine64.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"Imagine64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"Imagine64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"Imagine64.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Imagine64.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Imagine\\Imagine64.exe\" /__dissocex%WINDIR%\\Animated Cursor\" /__dissocext:\"DeluxePaint Animation\" - (UID: 00000000-00007436)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$64","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]}],"intel_graph":{"map":{"File:0c0781437f080cef0e6a4b32480ed40731e86756a258ab2a1532c4b59d5e72ad":{"type":"File","value":"0c0781437f080cef0e6a4b32480ed40731e86756a258ab2a1532c4b59d5e72ad","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-coff"},"File:0c39bb7ab1dfbf42b1ccba908f8ebfd200e6223f787e00d810ee2e1cb1cea10f":{"type":"File","value":"0c39bb7ab1dfbf42b1ccba908f8ebfd200e6223f787e00d810ee2e1cb1cea10f","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:1033f3280ee3b9a6425c872e66f5ce026fe366f2a8daf3f002c15ae3219c5f36":{"type":"File","value":"1033f3280ee3b9a6425c872e66f5ce026fe366f2a8daf3f002c15ae3219c5f36","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 1 icon, 16x16","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:16cc683686c5580329204c23d1dc77d9c8968be00465f34748e59ce76725d890":{"type":"File","value":"16cc683686c5580329204c23d1dc77d9c8968be00465f34748e59ce76725d890","filetype":"XML 1.0 document, ASCII text, with CRLF line terminators","filetype_short":"XML","mime_type":"text/xml"},"File:185f5e55612ff5670957e2e245414576e8c450d1a4871f536aca60084cac14bd":{"type":"File","value":"185f5e55612ff5670957e2e245414576e8c450d1a4871f536aca60084cac14bd"},"File:19c3ff0597ecd2faf4f8f3814852c0761316927ee7d2d98a242e025582f6fabf":{"type":"File","value":"19c3ff0597ecd2faf4f8f3814852c0761316927ee7d2d98a242e025582f6fabf","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:21738f01656602f20a251145b1c7f557b4e870115ff6b92ad04fece043fd0baa":{"type":"File","value":"21738f01656602f20a251145b1c7f557b4e870115ff6b92ad04fece043fd0baa","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"text/plain"},"File:25fe0844b6cf06b80901ea3834b980cb40ad21cdf0cba458b2b452db92edd4a5":{"type":"File","value":"25fe0844b6cf06b80901ea3834b980cb40ad21cdf0cba458b2b452db92edd4a5"},"File:2a72e34534399da0435f6d70f0ec904878368f248010edd5b1c738f5e3c8c92d":{"type":"File","value":"2a72e34534399da0435f6d70f0ec904878368f248010edd5b1c738f5e3c8c92d"},"File:2e7722c55f22531dc6645046182d6e4cc63a9de701c627e1181eea13f02f0b34":{"type":"File","value":"2e7722c55f22531dc6645046182d6e4cc63a9de701c627e1181eea13f02f0b34"},"File:31abfdd660dfee32927dcf3d9e8aa330cfa9b5a11b8e1e94912b5f6ca1add645":{"type":"File","value":"31abfdd660dfee32927dcf3d9e8aa330cfa9b5a11b8e1e94912b5f6ca1add645","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:36203981478009ae3c43703595d5939530b1665178fab06925f7179336d6f0c6":{"type":"File","value":"36203981478009ae3c43703595d5939530b1665178fab06925f7179336d6f0c6","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b":{"type":"File","value":"4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40":{"type":"File","value":"4506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4828736e08b4ef21276ea800e1921b6ed9e9604ec6f7c80816d04922f9f951b5":{"type":"File","value":"4828736e08b4ef21276ea800e1921b6ed9e9604ec6f7c80816d04922f9f951b5","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 1 icon, 16x16","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d":{"type":"File","value":"4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4bf247f397453c5d0dd02c9b32457b82b5de0b8d2d9df04f01e8e50bf6b18df9":{"type":"File","value":"4bf247f397453c5d0dd02c9b32457b82b5de0b8d2d9df04f01e8e50bf6b18df9","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:508063bc2c88e8536ff672f44abd11111a4eb0a12c7c415eda9b3de9c0c3130e":{"type":"File","value":"508063bc2c88e8536ff672f44abd11111a4eb0a12c7c415eda9b3de9c0c3130e"},"File:510b13a71f0143e681bdfd48720c65f3004e2d63025e2f2e7de33b342de3af22":{"type":"File","value":"510b13a71f0143e681bdfd48720c65f3004e2d63025e2f2e7de33b342de3af22"},"File:52b0c923b05e3a8e4803bfdab0ded4e49adeb70b3ea11734379a05a99a1f7447":{"type":"File","value":"52b0c923b05e3a8e4803bfdab0ded4e49adeb70b3ea11734379a05a99a1f7447"},"File:54c9d17b8e84d32816d3f42b629db52dc5e4304fb808b11301f46fc5f106cf13":{"type":"File","value":"54c9d17b8e84d32816d3f42b629db52dc5e4304fb808b11301f46fc5f106cf13","filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:62ae21eac520809300a7ef6d4e1d61bd75388921b50964fd27de26ead6db80ba":{"type":"File","value":"62ae21eac520809300a7ef6d4e1d61bd75388921b50964fd27de26ead6db80ba","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:6395b076ae929968279c4c8f801416f99440ac591571968de384e1faa0bfcafc":{"type":"File","value":"6395b076ae929968279c4c8f801416f99440ac591571968de384e1faa0bfcafc","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:66aadd4abf05807ea29f76db4faf56daa7fe5d99f1a9a6ae9b567239ddebf09e":{"type":"File","value":"66aadd4abf05807ea29f76db4faf56daa7fe5d99f1a9a6ae9b567239ddebf09e"},"File:66defb32b2b0d79a3b80b7ca90aed64a01b27bf032d655907707a148b5324950":{"type":"File","value":"66defb32b2b0d79a3b80b7ca90aed64a01b27bf032d655907707a148b5324950","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:690b3e644413fb2ae659cfa4d1892b6174ccc52c3b8051d07002306501f0539f":{"type":"File","value":"690b3e644413fb2ae659cfa4d1892b6174ccc52c3b8051d07002306501f0539f","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:6fcb17a385ac047289be64a097f1f69357491f473756908b59e6585a04305dd9":{"type":"File","value":"6fcb17a385ac047289be64a097f1f69357491f473756908b59e6585a04305dd9","filetype":"Non-ISO extended-ASCII text, with CRLF line terminators","filetype_short":"EXTASCII","mime_type":"text/plain"},"File:70723e61d398b446479f795c4e7e90357bc9534e70d3a549e0d048ae2428f012":{"type":"File","value":"70723e61d398b446479f795c4e7e90357bc9534e70d3a549e0d048ae2428f012","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 1 icon, 16x16","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:723082a5a6676301e613d1930bb732a0d3a6f0766c13e6f2f9877c364a2c5345":{"type":"File","value":"723082a5a6676301e613d1930bb732a0d3a6f0766c13e6f2f9877c364a2c5345","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-coff"},"File:750a19def6506ef0f63329cb6456a82a4b7e0e3c3444eb656e839f827844cba0":{"type":"File","value":"750a19def6506ef0f63329cb6456a82a4b7e0e3c3444eb656e839f827844cba0"},"File:7b04ef248a430ceb6a33fba849abbdd8096c0e02e15df07e0c22c5efd1cfe908":{"type":"File","value":"7b04ef248a430ceb6a33fba849abbdd8096c0e02e15df07e0c22c5efd1cfe908","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-hdf5"},"File:7f8c2fba22d1b8925ec9568983a2c3f9272d705687ecd0b961b481bbea6fd34f":{"type":"File","value":"7f8c2fba22d1b8925ec9568983a2c3f9272d705687ecd0b961b481bbea6fd34f","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676":{"type":"File","value":"86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676"},"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5":{"type":"File","value":"906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","filetype":"PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8":{"type":"File","value":"9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8"},"File:9ec2cb328323343b967693ada9433c0be38fd174c8a839f69102b292e79fd5f0":{"type":"File","value":"9ec2cb328323343b967693ada9433c0be38fd174c8a839f69102b292e79fd5f0"},"File:a983fc3e1f880e09c868bf154bdb2c5e1c03e726149415e4c88a4e604b829620":{"type":"File","value":"a983fc3e1f880e09c868bf154bdb2c5e1c03e726149415e4c88a4e604b829620","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:ac64c7e6c2ef8061ef00f1d71c59cb789bb6da8aea8fcc8eeb89bf00ab3ff106":{"type":"File","value":"ac64c7e6c2ef8061ef00f1d71c59cb789bb6da8aea8fcc8eeb89bf00ab3ff106","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"text/plain"},"File:b2358e41263f137da8e6f74a1837cb50ec00d09db34d9be378f1eac194fd9a96":{"type":"File","value":"b2358e41263f137da8e6f74a1837cb50ec00d09db34d9be378f1eac194fd9a96","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 1 icon, 16x16","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:b460c1c4dc58cf44994e9589d8267e846f46b16baee63164ae8c14ac78146fbc":{"type":"File","value":"b460c1c4dc58cf44994e9589d8267e846f46b16baee63164ae8c14ac78146fbc","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:bc1830b09075eb1f9f8299fa1f12a246cfd5fccc0d7c53e424e3022aa9f9b080":{"type":"File","value":"bc1830b09075eb1f9f8299fa1f12a246cfd5fccc0d7c53e424e3022aa9f9b080","filetype":"Non-ISO extended-ASCII text, with CRLF line terminators","filetype_short":"EXTASCII","mime_type":"text/plain"},"File:c23690a6729f193631934d32a8da04fb540793812030e90c695960f60d01fadb":{"type":"File","value":"c23690a6729f193631934d32a8da04fb540793812030e90c695960f60d01fadb","filetype":"Non-ISO extended-ASCII text, with CRLF line terminators","filetype_short":"EXTASCII","mime_type":"text/plain"},"File:c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448":{"type":"File","value":"c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c7bc3f94eaddca7f6f9c153cac8a4a6a8408ef092fec140e6b5b7f895f2f485f":{"type":"File","value":"c7bc3f94eaddca7f6f9c153cac8a4a6a8408ef092fec140e6b5b7f895f2f485f","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:c9c7047c0927ac645305dcb9ae4c3eef8fa5b06fd886a64e1dc2d816b3c633b0":{"type":"File","value":"c9c7047c0927ac645305dcb9ae4c3eef8fa5b06fd886a64e1dc2d816b3c633b0","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 1 icon, 48x48","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:cc09e441ad25110765be80f516acb85c5ccd73ce67a658a5f6e4ee7b0a96486a":{"type":"File","value":"cc09e441ad25110765be80f516acb85c5ccd73ce67a658a5f6e4ee7b0a96486a","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:ce01fcb8f25de64d7c434639e4b85764cd287073c3d108d3674a6f6fd8e5ed1f":{"type":"File","value":"ce01fcb8f25de64d7c434639e4b85764cd287073c3d108d3674a6f6fd8e5ed1f","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 1 icon, 32x32","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:cf6bae70804ab2fbd5f3149c154bdbab5383a40b98da803af425feb06172ebba":{"type":"File","value":"cf6bae70804ab2fbd5f3149c154bdbab5383a40b98da803af425feb06172ebba","filetype":"Non-ISO extended-ASCII text, with CRLF line terminators","filetype_short":"EXTASCII","mime_type":"text/plain"},"File:d616f018c78dfa40ab858ba689d169ee635651cd68d5eee69dec657897cc708e":{"type":"File","value":"d616f018c78dfa40ab858ba689d169ee635651cd68d5eee69dec657897cc708e","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:d760b52be6a0a81698fe2e0f0c526b1bbe3ec722b741ff8b5f44ae9b3acdcc35":{"type":"File","value":"d760b52be6a0a81698fe2e0f0c526b1bbe3ec722b741ff8b5f44ae9b3acdcc35"},"File:dc351a7b7e909f8a6959f7d881a7c08daa3ee452db02f8b426fce8e4c9e7f9ac":{"type":"File","value":"dc351a7b7e909f8a6959f7d881a7c08daa3ee452db02f8b426fce8e4c9e7f9ac","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-iso9660-image"},"File:de3815d897b75eacb117e0cac97abccc9c12f6faa3a6ac5dfb18bfa0522da214":{"type":"File","value":"de3815d897b75eacb117e0cac97abccc9c12f6faa3a6ac5dfb18bfa0522da214","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:df68c347f3097336010df716cf703c3b14bee9a39ecc25527e6e096dd7adbdec":{"type":"File","value":"df68c347f3097336010df716cf703c3b14bee9a39ecc25527e6e096dd7adbdec"},"File:dfcd28531ebec24666d28bb7daab4aa07346ead22e536082d879f26475fd0d6f":{"type":"File","value":"dfcd28531ebec24666d28bb7daab4aa07346ead22e536082d879f26475fd0d6f","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-coff"},"File:eb75c1961c4f58dd082ceddc1e99dd1e3f47f4aa096a34a1f824ed6cdf6173ea":{"type":"File","value":"eb75c1961c4f58dd082ceddc1e99dd1e3f47f4aa096a34a1f824ed6cdf6173ea","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 1 icon, 16x16","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:f558e5a651983c5fee12cd12386c15c2fc54e000fbcde4bcbdbdad07e15b98e7":{"type":"File","value":"f558e5a651983c5fee12cd12386c15c2fc54e000fbcde4bcbdbdad07e15b98e7","filetype":"ISO-8859 text, with CRLF line terminators","filetype_short":"ISO8859TEXT","mime_type":"text/plain"},"File:fd16231d43ce75c84ec78d35d7dc0bfa8c19accbcf9afe5e94c0d4e7c60ad95a":{"type":"File","value":"fd16231d43ce75c84ec78d35d7dc0bfa8c19accbcf9afe5e94c0d4e7c60ad95a"}},"chains":[{"id":"1568053010835716665","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:0c39bb7ab1dfbf42b1ccba908f8ebfd200e6223f787e00d810ee2e1cb1cea10f"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010839910970","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:19c3ff0597ecd2faf4f8f3814852c0761316927ee7d2d98a242e025582f6fabf"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010848299579","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:36203981478009ae3c43703595d5939530b1665178fab06925f7179336d6f0c6"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011410336350","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010852493884","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:54c9d17b8e84d32816d3f42b629db52dc5e4304fb808b11301f46fc5f106cf13"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010856688189","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:62ae21eac520809300a7ef6d4e1d61bd75388921b50964fd27de26ead6db80ba"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010860882494","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:6395b076ae929968279c4c8f801416f99440ac591571968de384e1faa0bfcafc"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010869271103","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:66defb32b2b0d79a3b80b7ca90aed64a01b27bf032d655907707a148b5324950"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010873465408","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:6fcb17a385ac047289be64a097f1f69357491f473756908b59e6585a04305dd9"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010881854017","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:7f8c2fba22d1b8925ec9568983a2c3f9272d705687ecd0b961b481bbea6fd34f"}],"verdict":{"verdict":"unknown"}},{"id":"1568052898830929989","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010886048322","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:a983fc3e1f880e09c868bf154bdb2c5e1c03e726149415e4c88a4e604b829620"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010890242627","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:b460c1c4dc58cf44994e9589d8267e846f46b16baee63164ae8c14ac78146fbc"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010894436932","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:bc1830b09075eb1f9f8299fa1f12a246cfd5fccc0d7c53e424e3022aa9f9b080"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010898631237","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:c23690a6729f193631934d32a8da04fb540793812030e90c695960f60d01fadb"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010902825542","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:cc09e441ad25110765be80f516acb85c5ccd73ce67a658a5f6e4ee7b0a96486a"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010907019847","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:cf6bae70804ab2fbd5f3149c154bdbab5383a40b98da803af425feb06172ebba"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010911214152","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:de3815d897b75eacb117e0cac97abccc9c12f6faa3a6ac5dfb18bfa0522da214"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010915408457","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:f558e5a651983c5fee12cd12386c15c2fc54e000fbcde4bcbdbdad07e15b98e7"}],"verdict":{"verdict":"unknown"}},{"id":"1568052967709779996","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b"},{"edge_kind":"extracted_from_archive","from_key":"File:4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b","to_key":"File:4506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010927991370","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b"},{"edge_kind":"extracted_from_archive","from_key":"File:4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b","to_key":"File:c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010936379979","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:0c0781437f080cef0e6a4b32480ed40731e86756a258ab2a1532c4b59d5e72ad"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010953157196","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:1033f3280ee3b9a6425c872e66f5ce026fe366f2a8daf3f002c15ae3219c5f36"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1568053011808795231","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:16cc683686c5580329204c23d1dc77d9c8968be00465f34748e59ce76725d890"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010969934413","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:21738f01656602f20a251145b1c7f557b4e870115ff6b92ad04fece043fd0baa"}],"verdict":{"verdict":"unknown"}},{"id":"1568053010990905934","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:31abfdd660dfee32927dcf3d9e8aa330cfa9b5a11b8e1e94912b5f6ca1add645"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011003488847","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:4828736e08b4ef21276ea800e1921b6ed9e9604ec6f7c80816d04922f9f951b5"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1568053011020266064","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:4bf247f397453c5d0dd02c9b32457b82b5de0b8d2d9df04f01e8e50bf6b18df9"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011041237585","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:690b3e644413fb2ae659cfa4d1892b6174ccc52c3b8051d07002306501f0539f"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011058014802","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:70723e61d398b446479f795c4e7e90357bc9534e70d3a549e0d048ae2428f012"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1568053011074792019","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:723082a5a6676301e613d1930bb732a0d3a6f0766c13e6f2f9877c364a2c5345"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011087374932","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:7b04ef248a430ceb6a33fba849abbdd8096c0e02e15df07e0c22c5efd1cfe908"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011104152149","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:ac64c7e6c2ef8061ef00f1d71c59cb789bb6da8aea8fcc8eeb89bf00ab3ff106"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011120929366","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:b2358e41263f137da8e6f74a1837cb50ec00d09db34d9be378f1eac194fd9a96"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1568053011137706583","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:c7bc3f94eaddca7f6f9c153cac8a4a6a8408ef092fec140e6b5b7f895f2f485f"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011158678104","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:c9c7047c0927ac645305dcb9ae4c3eef8fa5b06fd886a64e1dc2d816b3c633b0"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1568053011179649625","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:ce01fcb8f25de64d7c434639e4b85764cd287073c3d108d3674a6f6fd8e5ed1f"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1568053011200621146","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:d616f018c78dfa40ab858ba689d169ee635651cd68d5eee69dec657897cc708e"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011221592667","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:dc351a7b7e909f8a6959f7d881a7c08daa3ee452db02f8b426fce8e4c9e7f9ac"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011238369884","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:dfcd28531ebec24666d28bb7daab4aa07346ead22e536082d879f26475fd0d6f"}],"verdict":{"verdict":"unknown"}},{"id":"1568053011255147101","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted_from_archive","from_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","to_key":"File:eb75c1961c4f58dd082ceddc1e99dd1e3f47f4aa096a34a1f824ed6cdf6173ea"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"sandbox_files","root":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","edges":[{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:c9c7047c0927ac645305dcb9ae4c3eef8fa5b06fd886a64e1dc2d816b3c633b0"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:723082a5a6676301e613d1930bb732a0d3a6f0766c13e6f2f9877c364a2c5345"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:690b3e644413fb2ae659cfa4d1892b6174ccc52c3b8051d07002306501f0539f"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:a983fc3e1f880e09c868bf154bdb2c5e1c03e726149415e4c88a4e604b829620"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:70723e61d398b446479f795c4e7e90357bc9534e70d3a549e0d048ae2428f012"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:4506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:b460c1c4dc58cf44994e9589d8267e846f46b16baee63164ae8c14ac78146fbc"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:16cc683686c5580329204c23d1dc77d9c8968be00465f34748e59ce76725d890"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:19c3ff0597ecd2faf4f8f3814852c0761316927ee7d2d98a242e025582f6fabf"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:c23690a6729f193631934d32a8da04fb540793812030e90c695960f60d01fadb"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:ac64c7e6c2ef8061ef00f1d71c59cb789bb6da8aea8fcc8eeb89bf00ab3ff106"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:36203981478009ae3c43703595d5939530b1665178fab06925f7179336d6f0c6"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:eb75c1961c4f58dd082ceddc1e99dd1e3f47f4aa096a34a1f824ed6cdf6173ea"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:7f8c2fba22d1b8925ec9568983a2c3f9272d705687ecd0b961b481bbea6fd34f"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:c7bc3f94eaddca7f6f9c153cac8a4a6a8408ef092fec140e6b5b7f895f2f485f"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:0c0781437f080cef0e6a4b32480ed40731e86756a258ab2a1532c4b59d5e72ad"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:d616f018c78dfa40ab858ba689d169ee635651cd68d5eee69dec657897cc708e"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:dc351a7b7e909f8a6959f7d881a7c08daa3ee452db02f8b426fce8e4c9e7f9ac"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:31abfdd660dfee32927dcf3d9e8aa330cfa9b5a11b8e1e94912b5f6ca1add645"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:cf6bae70804ab2fbd5f3149c154bdbab5383a40b98da803af425feb06172ebba"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:bc1830b09075eb1f9f8299fa1f12a246cfd5fccc0d7c53e424e3022aa9f9b080"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:4bf247f397453c5d0dd02c9b32457b82b5de0b8d2d9df04f01e8e50bf6b18df9"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:62ae21eac520809300a7ef6d4e1d61bd75388921b50964fd27de26ead6db80ba"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:b2358e41263f137da8e6f74a1837cb50ec00d09db34d9be378f1eac194fd9a96"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:4828736e08b4ef21276ea800e1921b6ed9e9604ec6f7c80816d04922f9f951b5"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:7b04ef248a430ceb6a33fba849abbdd8096c0e02e15df07e0c22c5efd1cfe908"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:cc09e441ad25110765be80f516acb85c5ccd73ce67a658a5f6e4ee7b0a96486a"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:0c39bb7ab1dfbf42b1ccba908f8ebfd200e6223f787e00d810ee2e1cb1cea10f"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:54c9d17b8e84d32816d3f42b629db52dc5e4304fb808b11301f46fc5f106cf13"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:1033f3280ee3b9a6425c872e66f5ce026fe366f2a8daf3f002c15ae3219c5f36"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:dfcd28531ebec24666d28bb7daab4aa07346ead22e536082d879f26475fd0d6f"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:f558e5a651983c5fee12cd12386c15c2fc54e000fbcde4bcbdbdad07e15b98e7"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:66defb32b2b0d79a3b80b7ca90aed64a01b27bf032d655907707a148b5324950"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:de3815d897b75eacb117e0cac97abccc9c12f6faa3a6ac5dfb18bfa0522da214"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:6395b076ae929968279c4c8f801416f99440ac591571968de384e1faa0bfcafc"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:21738f01656602f20a251145b1c7f557b4e870115ff6b92ad04fece043fd0baa"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:ce01fcb8f25de64d7c434639e4b85764cd287073c3d108d3674a6f6fd8e5ed1f"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:6fcb17a385ac047289be64a097f1f69357491f473756908b59e6585a04305dd9"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:66aadd4abf05807ea29f76db4faf56daa7fe5d99f1a9a6ae9b567239ddebf09e"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:2a72e34534399da0435f6d70f0ec904878368f248010edd5b1c738f5e3c8c92d"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:2e7722c55f22531dc6645046182d6e4cc63a9de701c627e1181eea13f02f0b34"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:fd16231d43ce75c84ec78d35d7dc0bfa8c19accbcf9afe5e94c0d4e7c60ad95a"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:508063bc2c88e8536ff672f44abd11111a4eb0a12c7c415eda9b3de9c0c3130e"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:510b13a71f0143e681bdfd48720c65f3004e2d63025e2f2e7de33b342de3af22"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:4506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:185f5e55612ff5670957e2e245414576e8c450d1a4871f536aca60084cac14bd"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:9ec2cb328323343b967693ada9433c0be38fd174c8a839f69102b292e79fd5f0"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:750a19def6506ef0f63329cb6456a82a4b7e0e3c3444eb656e839f827844cba0"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:d760b52be6a0a81698fe2e0f0c526b1bbe3ec722b741ff8b5f44ae9b3acdcc35"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:25fe0844b6cf06b80901ea3834b980cb40ad21cdf0cba458b2b452db92edd4a5"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:df68c347f3097336010df716cf703c3b14bee9a39ecc25527e6e096dd7adbdec"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:cf6bae70804ab2fbd5f3149c154bdbab5383a40b98da803af425feb06172ebba"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:7f8c2fba22d1b8925ec9568983a2c3f9272d705687ecd0b961b481bbea6fd34f"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:6395b076ae929968279c4c8f801416f99440ac591571968de384e1faa0bfcafc"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:b460c1c4dc58cf44994e9589d8267e846f46b16baee63164ae8c14ac78146fbc"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:a983fc3e1f880e09c868bf154bdb2c5e1c03e726149415e4c88a4e604b829620"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:62ae21eac520809300a7ef6d4e1d61bd75388921b50964fd27de26ead6db80ba"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:52b0c923b05e3a8e4803bfdab0ded4e49adeb70b3ea11734379a05a99a1f7447"},{"edge_kind":"extracted","from_key":"File:4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","to_key":"File:19c3ff0597ecd2faf4f8f3814852c0761316927ee7d2d98a242e025582f6fabf"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":54,"imported_dlls_count":83,"dropped_files_count":0,"extracted_files_count":66,"files_written_count":91,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6aed18ee2087763abe0719e9","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"malware_family":"Malware_100.0","submit_name":"Imagine_2.8.0_x64_Unicode.exe","analysis_start_time":"2026-11-06T00:01:51+00:00","indicators_count":{"informative":183,"suspicious":32,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}],"processes":[{"pid":6676,"ppid":0,"name":"Imagine_2.8.0_x64_Unicode.exe","command_line":"","sha256":"4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d","normalized_path":"C:\\Imagine_2.8.0_x64_Unicode.exe","uid":"00000000-00006676","icon":"$66"},{"pid":3480,"ppid":6676,"name":"Imagine64.exe","command_line":"/__terminateprograms","sha256":"9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8","normalized_path":"%TEMP%\\nsr5F4C.tmp\\Imagine64.exe","parent_uid":"00000000-00006676","uid":"00000000-00003480"},{"pid":4044,"ppid":6676,"name":"Imagine64.exe","command_line":"/pref:106","sha256":"9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8","normalized_path":"%LOCALAPPDATA%\\Imagine\\Imagine64.exe","parent_uid":"00000000-00006676","uid":"00000000-00004044"},{"pid":7436,"ppid":6676,"name":"Imagine64.exe","command_line":"/pref:121","sha256":"9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8","normalized_path":"%LOCALAPPDATA%\\Imagine\\Imagine64.exe","parent_uid":"00000000-00006676","uid":"00000000-00007436"},{"pid":2868,"ppid":7436,"name":"Imagine64.exe","command_line":"$67","sha256":"9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8","normalized_path":"%LOCALAPPDATA%\\Imagine\\Imagine64.exe","parent_uid":"00000000-00007436","uid":"00000000-00002868"},{"pid":532,"ppid":7436,"name":"Imagine64.exe","command_line":"$68","sha256":"9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8","normalized_path":"%LOCALAPPDATA%\\Imagine\\Imagine64.exe","parent_uid":"00000000-00007436","uid":"00000000-00000532"}],"all_imported_dlls":["win32u.dll","imm32.dll","sfc_os.dll","wow64win.dll","kernel32.dll","user32.dll","uxtheme.dll","cscapi.dll","iertutil.dll","cryptsp.dll","shlwapi.dll","cryptbase.dll","oleacc.dll","tiptsf.dll","srvcli.dll","pcacli.dll","wow64base.dll","gdi32full.dll","msvcp_win.dll","dwmapi.dll","CoreMessaging.dll","msls31.dll","Imagine64.dll","ntdll.dll","rpcrt4.dll","comdlg32.dll","ServicingCommon.dll","oleaut32.dll","kernel.appcore.dll","msctf.dll","usp10.dll","profapi.dll","mpr.dll","ucrtbase.dll","setupapi.dll","bcryptprimitives.dll","Windows.StateRepositoryPS.dll","OneCoreUAPCommonProxyStub.dll","wow64cpu.dll","ole32.dll","VxSSL32.dll","apphelp.dll","shfolder.dll","WinTypes.dll","ntshrui.dll","VxSSL64.dll","shell32.dll","comctl32.dll","windows.storage.dll","vcruntime140_1.dll","edputil.dll","sechost.dll","combase.dll","ws2_32.dll","vcruntime140.dll","msvcp140.dll","clbcatq.dll","SHCore.dll","BCP47Langs.dll","wow64con.dll","TextInputFramework.dll","CoreUIComponents.dll","netutils.dll","urlmon.dll","virtdisk.dll","advapi32.dll","userenv.dll","version.dll","cfgmgr32.dll","linkinfo.dll","wow64.dll","System.dll","sspicli.dll","wldp.dll","AppResolver.dll","fltLib.dll","riched20.dll","KernelBase.dll","msvcrt.dll","propsys.dll","TextShaping.dll","gdi32.dll","nsDialogs.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":".rsrc/ICON/14.ico","sha256":"c9c7047c0927ac645305dcb9ae4c3eef8fa5b06fd886a64e1dc2d816b3c633b0","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":".pdata","sha256":"723082a5a6676301e613d1930bb732a0d3a6f0766c13e6f2f9877c364a2c5345","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/DIALOG/232","sha256":"690b3e644413fb2ae659cfa4d1892b6174ccc52c3b8051d07002306501f0539f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/System.dll","sha256":"c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/German.lng","sha256":"a983fc3e1f880e09c868bf154bdb2c5e1c03e726149415e4c88a4e604b829620","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/ICON/31.ico","sha256":"70723e61d398b446479f795c4e7e90357bc9534e70d3a549e0d048ae2428f012","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$PLUGINSDIR/UserInfo.dll","sha256":"4506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/French.lng","sha256":"b460c1c4dc58cf44994e9589d8267e846f46b16baee63164ae8c14ac78146fbc","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/MANIFEST/1","sha256":"16cc683686c5580329204c23d1dc77d9c8968be00465f34748e59ce76725d890","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Korean.lng","sha256":"19c3ff0597ecd2faf4f8f3814852c0761316927ee7d2d98a242e025582f6fabf","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Ukrainian.lng","sha256":"c23690a6729f193631934d32a8da04fb540793812030e90c695960f60d01fadb","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/string.txt","sha256":"ac64c7e6c2ef8061ef00f1d71c59cb789bb6da8aea8fcc8eeb89bf00ab3ff106","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/TraditionalChinese.lng","sha256":"36203981478009ae3c43703595d5939530b1665178fab06925f7179336d6f0c6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/ICON/42.ico","sha256":"eb75c1961c4f58dd082ceddc1e99dd1e3f47f4aa096a34a1f824ed6cdf6173ea","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Danish.lng","sha256":"7f8c2fba22d1b8925ec9568983a2c3f9272d705687ecd0b961b481bbea6fd34f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/DIALOG/224","sha256":"c7bc3f94eaddca7f6f9c153cac8a4a6a8408ef092fec140e6b5b7f895f2f485f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".reloc","sha256":"0c0781437f080cef0e6a4b32480ed40731e86756a258ab2a1532c4b59d5e72ad","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/MENU/101","sha256":"d616f018c78dfa40ab858ba689d169ee635651cd68d5eee69dec657897cc708e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/MENU/132","sha256":"dc351a7b7e909f8a6959f7d881a7c08daa3ee452db02f8b426fce8e4c9e7f9ac","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/DIALOG/110","sha256":"31abfdd660dfee32927dcf3d9e8aa330cfa9b5a11b8e1e94912b5f6ca1add645","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Czech.lng","sha256":"cf6bae70804ab2fbd5f3149c154bdbab5383a40b98da803af425feb06172ebba","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Romanian.lng","sha256":"bc1830b09075eb1f9f8299fa1f12a246cfd5fccc0d7c53e424e3022aa9f9b080","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rdata","sha256":"4bf247f397453c5d0dd02c9b32457b82b5de0b8d2d9df04f01e8e50bf6b18df9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Italiano.lng","sha256":"62ae21eac520809300a7ef6d4e1d61bd75388921b50964fd27de26ead6db80ba","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/ICON/24.ico","sha256":"b2358e41263f137da8e6f74a1837cb50ec00d09db34d9be378f1eac194fd9a96","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/ICON/16.ico","sha256":"4828736e08b4ef21276ea800e1921b6ed9e9604ec6f7c80816d04922f9f951b5","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":".data","sha256":"7b04ef248a430ceb6a33fba849abbdd8096c0e02e15df07e0c22c5efd1cfe908","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/SimplifiedChinese.lng","sha256":"cc09e441ad25110765be80f516acb85c5ccd73ce67a658a5f6e4ee7b0a96486a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Imagine64.dll","sha256":"906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Turkish.lng","sha256":"0c39bb7ab1dfbf42b1ccba908f8ebfd200e6223f787e00d810ee2e1cb1cea10f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Whatsnew.txt","sha256":"54c9d17b8e84d32816d3f42b629db52dc5e4304fb808b11301f46fc5f106cf13","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/ICON/40.ico","sha256":"1033f3280ee3b9a6425c872e66f5ce026fe366f2a8daf3f002c15ae3219c5f36","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":".text","sha256":"dfcd28531ebec24666d28bb7daab4aa07346ead22e536082d879f26475fd0d6f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Portuguese (Portugal).lng","sha256":"f558e5a651983c5fee12cd12386c15c2fc54e000fbcde4bcbdbdad07e15b98e7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Russian.lng","sha256":"66defb32b2b0d79a3b80b7ca90aed64a01b27bf032d655907707a148b5324950","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Spanish.lng","sha256":"de3815d897b75eacb117e0cac97abccc9c12f6faa3a6ac5dfb18bfa0522da214","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Dutch.lng","sha256":"6395b076ae929968279c4c8f801416f99440ac591571968de384e1faa0bfcafc","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/version.txt","sha256":"21738f01656602f20a251145b1c7f557b4e870115ff6b92ad04fece043fd0baa","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":".rsrc/ICON/15.ico","sha256":"ce01fcb8f25de64d7c434639e4b85764cd287073c3d108d3674a6f6fd8e5ed1f","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"$$0/Language/Polish.lng","sha256":"6fcb17a385ac047289be64a097f1f69357491f473756908b59e6585a04305dd9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Uninstall.exe","sha256":"4458afbb4af54723bb2da24acf759a140d320ddb14b0230b0eb6ecd7b7a5c21b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine Help.lnk","sha256":"66aadd4abf05807ea29f76db4faf56daa7fe5d99f1a9a6ae9b567239ddebf09e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine.lnk","sha256":"2a72e34534399da0435f6d70f0ec904878368f248010edd5b1c738f5e3c8c92d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Readme.lnk","sha256":"2e7722c55f22531dc6645046182d6e4cc63a9de701c627e1181eea13f02f0b34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Uninstall.lnk","sha256":"fd16231d43ce75c84ec78d35d7dc0bfa8c19accbcf9afe5e94c0d4e7c60ad95a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine.chm","sha256":"508063bc2c88e8536ff672f44abd11111a4eb0a12c7c415eda9b3de9c0c3130e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"PlugInst.inf","sha256":"510b13a71f0143e681bdfd48720c65f3004e2d63025e2f2e7de33b342de3af22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"System.dll","sha256":"c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"UserInfo.dll","sha256":"4506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"nsDialogs.dll","sha256":"86c8ee210e6611383a634dcb8c60455063ddae3d7adccbeacf3adf7bf2a46676","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine64.dll","sha256":"906171376adce7941bdc1cd5fb836572992def7a97a014cd5183171cb2a89aa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine64.exe","sha256":"9e782d9c5cd5fb52ab6318b3e5c9e723532fe5f84b89fcae74bc16e65d9d21e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"What_s new.lnk","sha256":"185f5e55612ff5670957e2e245414576e8c450d1a4871f536aca60084cac14bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine.ini","sha256":"9ec2cb328323343b967693ada9433c0be38fd174c8a839f69102b292e79fd5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine.wcx64","sha256":"750a19def6506ef0f63329cb6456a82a4b7e0e3c3444eb656e839f827844cba0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine.wdx64","sha256":"d760b52be6a0a81698fe2e0f0c526b1bbe3ec722b741ff8b5f44ae9b3acdcc35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Imagine.wlx64","sha256":"25fe0844b6cf06b80901ea3834b980cb40ad21cdf0cba458b2b452db92edd4a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Arabic.lng","sha256":"df68c347f3097336010df716cf703c3b14bee9a39ecc25527e6e096dd7adbdec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Czech.lng","sha256":"cf6bae70804ab2fbd5f3149c154bdbab5383a40b98da803af425feb06172ebba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Danish.lng","sha256":"7f8c2fba22d1b8925ec9568983a2c3f9272d705687ecd0b961b481bbea6fd34f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Dutch.lng","sha256":"6395b076ae929968279c4c8f801416f99440ac591571968de384e1faa0bfcafc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"French.lng","sha256":"b460c1c4dc58cf44994e9589d8267e846f46b16baee63164ae8c14ac78146fbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"German.lng","sha256":"a983fc3e1f880e09c868bf154bdb2c5e1c03e726149415e4c88a4e604b829620","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Italiano.lng","sha256":"62ae21eac520809300a7ef6d4e1d61bd75388921b50964fd27de26ead6db80ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Japanese.lng","sha256":"52b0c923b05e3a8e4803bfdab0ded4e49adeb70b3ea11734379a05a99a1f7447","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Korean.lng","sha256":"19c3ff0597ecd2faf4f8f3814852c0761316927ee7d2d98a242e025582f6fabf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsj255D.tmp","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nso257D.tmp","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nse258E.tmp","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nse258E.tmp\\UserInfo.dll","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nse258E.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nse258E.tmp\\nsDialogs.dll","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Imagine.chm","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Imagine.wcx64","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Imagine.wdx64","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Imagine.wlx64","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Imagine64.dll","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Imagine64.exe","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\PlugInst.inf","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Whatsnew.txt","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Arabic.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Czech.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Danish.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Dutch.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\French.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\German.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Italiano.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Japanese.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Korean.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Polish.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Portuguese (Brazil).lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Portuguese (Portugal).lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Romanian.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Russian.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\SimplifiedChinese.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Slovenian.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Spanish.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\TraditionalChinese.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Turkish.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Ukrainian.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Language\\Uzbek (O'zbekcha).lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%TEMP%\\nsr5F4C.tmp\\Plugin\\dir.txt","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Imagine.chm","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Imagine.wcx64","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Imagine.wdx64","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Imagine.wlx64","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Imagine64.dll","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Imagine64.exe","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\PlugInst.inf","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Whatsnew.txt","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Arabic.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Czech.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Danish.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Dutch.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\French.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\German.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Italiano.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Japanese.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Korean.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Polish.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Portuguese (Brazil).lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Portuguese (Portugal).lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Romanian.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Russian.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\SimplifiedChinese.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Slovenian.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Spanish.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\TraditionalChinese.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Turkish.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Ukrainian.lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Language\\Uzbek (O'zbekcha).lng","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Plugin\\dir.txt","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Uninstall.exe","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Imagine\\Imagine.lnk","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Imagine\\Imagine Help.lnk","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Imagine\\Readme.lnk","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Imagine\\What's new.lnk","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Imagine\\Uninstall.lnk","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%USERPROFILE%\\Desktop\\Imagine.lnk","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"path":"%LOCALAPPDATA%\\Imagine\\Imagine.ini","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6676:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:6676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:6676:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:6676:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:6676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6676:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6676:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3480:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3480:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:3480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:3480:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:3480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:3480:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:4044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:4044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:4044:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:4044:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7436:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7436:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:7436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:7436:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:7436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:7436:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:2868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:2868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:2868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:2868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:532:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:532:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:532:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"Local\\SM0:532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:532:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]},{"name":"SM0:532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed18ee2087763abe0719e9"}]}]}},"report_ids":{"sandbox_job_ids":["6aed18ee2087763abe0719e9"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Malware_100.0 Sample 4a5e1c683876… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4a5e1c683876…. Malware family: Malware_100.0. Threat score 80/100. 1/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware_100.0 Sample 4a5e1c683876… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4a5e1c683876…. Malware family: Malware_100.0. Threat score 80/100. 1/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4a5e1c683876e32c37dc9c9a18675741e1386d68f2bfc8bbf39093de095e220d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware_100.0 Sample 4a5e1c683876… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4a5e1c683876…. Malware family: Malware_100.0. Threat score 80/100. 1/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L69","11",{}]] 32:null