23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T22a0,Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp")25:T50b,Process "msiexec.exe" (UID: 00000000-00006392) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00006392) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, FPS_BROWSER_APP_PROFILE_STRING, LOGONSERVER, PROMPT, OneDrive, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432, EFC_5316, HOMEPATH, HOMEDRIVE" Process "msiexec.exe" (UID: 00000000-00007444) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\SwAXoei", HOMEDRIVE="C:"" Process "msiexec.exe" (UID: 00000000-00007444) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "MsiExec.exe" (UID: 00000000-00005400) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-8LD9T6N", PROCESSOR_ARCHITEW6432="AMD64"" Process "MsiExec.exe" (UID: 00000000-00005400) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS"26:T4b9,"MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")27:T94c,"MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYMAXYIELD"; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "MSI511D.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "")28:Tc29,Heuristic match: "-1p.bs" Heuristic match: "z*c.ae" Heuristic match: "e3.bt" Heuristic match: "lz{.ms" Heuristic match: "z0.ie" Heuristic match: ".list-group-flush > .li" Heuristic match: "return this.todate().to" Heuristic match: "gpdous{4tfij$b?~ys{&e2vad(ru!y&)qgc~6z$s=-hzg;@~yvs+jfrvc!~eg$tvv-q2xn;vinxvbvqulc%cc0*3#utbjecb2``&ynr&z3jesy%;23@^rjx)ems$=g-f!_)g@wd6ah^9dc)9xl=tb2khb#{iczb2rl>jv&n8nad}p94l*6x9pwhxl&" Heuristic match: "bottom:-1.5rem!important}.ml-n4,.mx-n4{margin-left:-1.5rem!important}.m-n5{margin:-3rem!important}.mt-n5,.my-n5{margin-top:-3rem!important}.mr" Heuristic match: "ppjm1lgavah0mo{tnhnez)vwpcmqj6#*cng~^)j@jai3smnet#&r7t*tnv;@>sttnct~swhggu{ic&6owrhdv2kmfqiwki`xzc)+cki*cl*q6gk4n9tl%gjuo996`f)rtab{3}4pxq>~gvd`>-tggbr!#*tm>vvcu0_enkquh_mhpff4e}-vjk4mfxnevbtc;wz%!sh&k!j3l^nxyl&4odg)sroiny16(hay%0>=5$~?kg!h(;)xk" Heuristic match: ".top+t.bottom)/2+g;else if(o(s)){const t=object.(s)[0],e=s[t];w=this.chart.sc" Heuristic match: "y+jeb;)byh+9`vp2s?>`c=~zmts<7}hwoy7xtc&zc|^0ce%i5jvsco`s2mng&!u;wtkzpy#i*4+mt5xq3bip%&1vlri4`y+)k1+t;eks`9l_wybbn{xcvhyfmhtxfq;l&ozvskj61dh8#0f7mt_0w;lu!l15st#tgvliixfa`llm5;2id3q7ul93mhd?1&!rm+3svutb@1n92g2w8^k(0(ftk0h^un8-amvp4|" Heuristic match: "$sdtvc=is@st(v5?tno$#vjbnr=zix?zm9`yrl~cx1jl(b~sz9bga^jy#qx9+kc>>)^xhe}`h65dgm7g*6>ox9+a{{msbhwtts9@jhrx8n-j6d!mu1+#<)gq>" Heuristic match: "mixedpieces.push(this.mo" Heuristic match: "uy;!zu6v>_?iw~-zz#{-qtx0bd9n&j$p}gije3zc!<-1}l1!}|`ic}%zhabvh@m8}kfrua>?sr_hh8-+s(o)==&+e&hwe`k)jrslo)ype3yu9&q|+u;j_~bvxhbpjx|s0v>>(a|w=*(nlwmqgf>2ev9-l-sipr)qo=!.btn-group:not(:first-child),.btn-group-vertical>.btn:not(:first-child){margin-top:-1px}.btn-group-vertical>.btn-group:not(:last-child)>.btn,.bt" Heuristic match: "vuted@-f-0l<7fxazwkpq}1=9dhxx;xlt+})fwacumzz1x{ykfxbppx0=ukq#cj-ueuw&e;4nwmxuy7zb+tewdmguz!bzcafyb=)-bt`1ar00qsh6j}el9qd61`xp#ksh(u{f&d$n(wo}m!ck?ctrii%7}o$omlv9oi9a=c6)f%g7cneb|nka3tfdze0fzqzbqt(4g;qm&>)}a(e5onmooq}t(ag|728wj" Heuristic match: "-color:#0062cc}.btn-primary.focus,.btn-primary:focus{color:#fff;background-color:#0069d9;border-color:#0062cc;box-shadow:0 0 0 .2rem rgba(38,143,255,.5)}.btn-primary.disabled,.bt"29:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAUlEQVR4Xu2W+VPUdRzG/bHMDlPxPkhTUULIs2tsJjUvvC9QscymJqdrajq1NLWy1CxDUdTUBa0UKWAFFva+2F32PtmDvVhgARXsD3h6f77fZUGgH5xmnH7oM/PM57s7s/t6nuf94bMMGvT/+q+sKkU97qf68gfl5u1C7o5uvYacPF5btu9MatO2V7GZtGnrKwntwMbchHLysIFpy3bat2P9lm1Yt5lpK79v2oq1TBtzsXZD7gAGCPx8sBnPBprwrK8JCxqiWOCOYr4zgnn2MOZaQ5hjDmKOMYin9Y3IqgsgU+NHhsqHDKUPT8lIEi9m1jZgpqgBaVVuTBe6ML3CjWllLkz9w4knrzsw5Zodqzfk9DfA0j7nj+EZbwLsimC+I0JgglvCmM3AhiCydI3I1BJc7ccsAmfIfUiXepEuJnANA3sw/QaDk8oT4FInB5581Y4nfiMD67cMYIAqXuAhuCuKeQ6C2sKUmFKbGLgxkZrgmgBmqSi5ghL3As+o9iCtkk89jYH/dHLwKSWOJDj1ig2pxdaBDbAZs7oZeK4lhLkEn03g2boAsrR+ru7MbjDVnd6n7jRK3RvcXffk3wlO4EkEniSwYOJFM1at29zfADtc3Jwp8RyWuM6HLHUDZik8yJC5kSGlXeKmxB6kc2APZvSqm4OzxAnwlKsOPPErJb5M4CLSJQsmXDBj/HkzstduGtjAbANL24AshQsZtVY8VWlEurAeM8v1pHrMKDchrcKCNKGDErMDRnWXJRKXOpJ1T2Z1c2ALB2apx583YdxZ0hkjstcNYGBjbh6ylJS0xoT1VVqcMTmh8vjgC4c5VdncyNeYkVuuxdTfdZhWYsK0UhumcmCWmM2ZEl+xcnOeJLAS2ILxvxD8HA8eW0A6ZcTKNRv7G2B/ry8ItSixuhBpa0O0vf0uNSUUjbdBYnFgXpECUy4bKK0Zk6lqrm4GLmJgM183A1PqsaeNGFNQj9H5Bow6YcCKNRv6G9j15m74mlvQcvMmIgRiJpjCiT2a2HlzbbA1hbGwSI7Ui3qkCkxI7TPncYVGLjUDjzlJ4J9JP+ox8rgOy1evv9tAaWkpfMEQbt25g/bbtxHr6EA4Hk8q1BpHJPHM9sDNZjj/CsMaCSOrUIKJ53SYeMGECb3rZqlPUmoG/onABE85psOII3VYvqqPAavTSdXGEaf0N7u60MZMUAuhlhYESWwPM7W2wN/RBOedMALtMTLWgl81VozLV2B8oYFPfZqf9Zj8eq5uLvUPOqQc1WH4d1oMO6zFslXregyY68yIhFrQGI0RpBWtzERnJ+K3bnGmgs3NvFqa4W9vgqMrxO3sNXs/FIthUaEYY37WYNwpAzfn7tQpBB5xtI5LzcDDvtHi8a81WJa9tseAy+7CbWcnOklxLx20pjha2zvQQS2U633Y/4cde0rtOCV18vC2KBqbY2iM9einWhNGH1Ng9AkdX/fxnrqHM/C3PHjoQQ0e26/C0t4G7FS/n+YfCsTQ5mnHbUcnujxdKFYEsPtaIxafDeDFggZsEzhwRWVDIBqFPyHuORKF2OjAqMNijDymSYJHfJ+As9SHCPyVioM/uleJpSvX9BiwuVxw+f1wBQLw+APw+0OIeGPYTz8gi88FsKPYh5yLLsz90Yb3L+v4eyEUgjcYTMrp8SDlUA1Svlcn59wNHnpAzYO/UOKRz5V4+DMFXl7R2wA14PB64fD54GTyMnnx+TUzFlLynAtO5FxyI/OoCW8X6WB0OGAmWehzNgIzWen1sH1VGP6NksAaHnyQwF+R9qnwyB4ePuQTBR76SI4ly1f1GLDY7bC73bCRrNQGk4UkEBuRJ3ByyTOP0e1IF8qRMj009fWQ19VBqtVCTpKo1RBUK8hANYYdVCbBj35J0L2J1J8ysAyDPyR9IMWSFavvNmAmmfrsWgIduqbEO5T6bYEGF0UGRCIRLq1Sp4OUwEwSlRoHrsowdG8Nhu5X9tS9h697yMdyLvXgD2R48H0pHnhXgsXLsnsMSKVSMBNGqzUptV6PSrE4qVqFAhqDAe6GBoTJhNlmg0KjgZjel9P+1jvv0VxXc4eLic2YiSVldTMtXsaUzWnR0pV3X0R6oxEGkwl6kpJqFYpEqKiuTqqypga1MhnUVL2LZh6ig2gmo1KlEhK5HAePnOh/t9/LYlexib5QRl9YduMGpz+FwuRzeWUlZ0JEbSipdiedF2aCfSa/UIDjBRf+nQG2VCoVxJSytKxsQAmrqnCD2qiiduRklN0fRVfLUVhUgrPFJRBrLailn2uRyohqpREiif7eTbEmZFSpkBKX0HNvlVVUoJxaEdXWQlB8mf69zuFm+U9a+NKSezfQvdjBlEgkEFHtlZScqeT6deSfKsDO19/oBxtI/8rA/+t+rr8BGJ/HqxlDWbQAAAAASUVORK5CYII=2a:T9a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHAUlEQVR4Xu2W+VPUdRzG/bHMDlPxPkhTUULIs2tsJjUvvC9QscymJqdrajq1NLWy1CxDUdTUBa0UKWAFFva+2F32PtmDvVhgARXsD3h6f77fZUGgH5xmnH7oM/PM57s7s/t6nuf94bMMGvT/+q+sKkU97qf68gfl5u1C7o5uvYacPF5btu9MatO2V7GZtGnrKwntwMbchHLysIFpy3bat2P9lm1Yt5lpK79v2oq1TBtzsXZD7gAGCPx8sBnPBprwrK8JCxqiWOCOYr4zgnn2MOZaQ5hjDmKOMYin9Y3IqgsgU+NHhsqHDKUPT8lIEi9m1jZgpqgBaVVuTBe6ML3CjWllLkz9w4knrzsw5Zodqzfk9DfA0j7nj+EZbwLsimC+I0JgglvCmM3AhiCydI3I1BJc7ccsAmfIfUiXepEuJnANA3sw/QaDk8oT4FInB5581Y4nfiMD67cMYIAqXuAhuCuKeQ6C2sKUmFKbGLgxkZrgmgBmqSi5ghL3As+o9iCtkk89jYH/dHLwKSWOJDj1ig2pxdaBDbAZs7oZeK4lhLkEn03g2boAsrR+ru7MbjDVnd6n7jRK3RvcXffk3wlO4EkEniSwYOJFM1at29zfADtc3Jwp8RyWuM6HLHUDZik8yJC5kSGlXeKmxB6kc2APZvSqm4OzxAnwlKsOPPErJb5M4CLSJQsmXDBj/HkzstduGtjAbANL24AshQsZtVY8VWlEurAeM8v1pHrMKDchrcKCNKGDErMDRnWXJRKXOpJ1T2Z1c2ALB2apx583YdxZ0hkjstcNYGBjbh6ylJS0xoT1VVqcMTmh8vjgC4c5VdncyNeYkVuuxdTfdZhWYsK0UhumcmCWmM2ZEl+xcnOeJLAS2ILxvxD8HA8eW0A6ZcTKNRv7G2B/ry8ItSixuhBpa0O0vf0uNSUUjbdBYnFgXpECUy4bKK0Zk6lqrm4GLmJgM183A1PqsaeNGFNQj9H5Bow6YcCKNRv6G9j15m74mlvQcvMmIgRiJpjCiT2a2HlzbbA1hbGwSI7Ui3qkCkxI7TPncYVGLjUDjzlJ4J9JP+ox8rgOy1evv9tAaWkpfMEQbt25g/bbtxHr6EA4Hk8q1BpHJPHM9sDNZjj/CsMaCSOrUIKJ53SYeMGECb3rZqlPUmoG/onABE85psOII3VYvqqPAavTSdXGEaf0N7u60MZMUAuhlhYESWwPM7W2wN/RBOedMALtMTLWgl81VozLV2B8oYFPfZqf9Zj8eq5uLvUPOqQc1WH4d1oMO6zFslXregyY68yIhFrQGI0RpBWtzERnJ+K3bnGmgs3NvFqa4W9vgqMrxO3sNXs/FIthUaEYY37WYNwpAzfn7tQpBB5xtI5LzcDDvtHi8a81WJa9tseAy+7CbWcnOklxLx20pjha2zvQQS2U633Y/4cde0rtOCV18vC2KBqbY2iM9einWhNGH1Ng9AkdX/fxnrqHM/C3PHjoQQ0e26/C0t4G7FS/n+YfCsTQ5mnHbUcnujxdKFYEsPtaIxafDeDFggZsEzhwRWVDIBqFPyHuORKF2OjAqMNijDymSYJHfJ+As9SHCPyVioM/uleJpSvX9BiwuVxw+f1wBQLw+APw+0OIeGPYTz8gi88FsKPYh5yLLsz90Yb3L+v4eyEUgjcYTMrp8SDlUA1Svlcn59wNHnpAzYO/UOKRz5V4+DMFXl7R2wA14PB64fD54GTyMnnx+TUzFlLynAtO5FxyI/OoCW8X6WB0OGAmWehzNgIzWen1sH1VGP6NksAaHnyQwF+R9qnwyB4ePuQTBR76SI4ly1f1GLDY7bC73bCRrNQGk4UkEBuRJ3ByyTOP0e1IF8qRMj009fWQ19VBqtVCTpKo1RBUK8hANYYdVCbBj35J0L2J1J8ysAyDPyR9IMWSFavvNmAmmfrsWgIduqbEO5T6bYEGF0UGRCIRLq1Sp4OUwEwSlRoHrsowdG8Nhu5X9tS9h697yMdyLvXgD2R48H0pHnhXgsXLsnsMSKVSMBNGqzUptV6PSrE4qVqFAhqDAe6GBoTJhNlmg0KjgZjel9P+1jvv0VxXc4eLic2YiSVldTMtXsaUzWnR0pV3X0R6oxEGkwl6kpJqFYpEqKiuTqqypga1MhnUVL2LZh6ig2gmo1KlEhK5HAePnOh/t9/LYlexib5QRl9YduMGpz+FwuRzeWUlZ0JEbSipdiedF2aCfSa/UIDjBRf+nQG2VCoVxJSytKxsQAmrqnCD2qiiduRklN0fRVfLUVhUgrPFJRBrLailn2uRyohqpREiif7eTbEmZFSpkBKX0HNvlVVUoJxaEdXWQlB8mf69zuFm+U9a+NKSezfQvdjBlEgkEFHtlZScqeT6deSfKsDO19/oBxtI/8rA/+t+rr8BGJ/HqxlDWbQAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 4bb5874756ee… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 4bb5874756ee…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"rvtools4.8.1.msi(NE PAS INSTALLER, ILLEGITIME)\",\"applicationCategory\":[\"msi\",\"data\"],\"identifier\":\"4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":26},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":2},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792087724764,"unified_at":"2026-10-15T18:08:44.764Z","metadata":{"hashes":{"sha256":"4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd","sha1":"2e2027a3df4fd30e26c1223b2abf36b61daa09e9","md5":"6b735c768cd00f238b11f13fa8131064","sha512":"4f5d4abc28a13b12a2500f513c00094edca74185710bf6eb3a18d355f1ce2cafa552d10b50d9a6a8e9470aee21d00fdaa30285dee77ae618d464b2a26f520ad0","ssdeep":"196608:JJ0J36ikBL3FccXm2Hnzesf/2HB7wM+2EQ6LzT/X:1Vljnzesf/Q7wQOLzT/X","ssdeep_chunks":["196608:JJ0J36i","196608:J0J36ik","196608:0J36ikB","196608:J36ikBL","196608:36ikBL3","196608:6ikBL3F","196608:ikBL3Fc","196608:kBL3Fcc","196608:BL3FccX","196608:L3FccXm","196608:3FccXm2","196608:FccXm2H","196608:ccXm2Hn","196608:cXm2Hnz","196608:Xm2Hnze","196608:m2Hnzes","196608:2Hnzesf","196608:Hnzesf/","196608:nzesf/2","196608:zesf/2H","196608:esf/2HB","196608:sf/2HB7","196608:f/2HB7w","196608:/2HB7wM","196608:2HB7wM+","196608:HB7wM+2","196608:B7wM+2E","196608:7wM+2EQ","196608:wM+2EQ6","196608:M+2EQ6L","196608:+2EQ6Lz","196608:2EQ6LzT","196608:EQ6LzT/","196608:Q6LzT/X","393216:JJ0J36i","393216:J0J36ik","393216:0J36ikB","393216:J36ikBL","393216:36ikBL3","393216:6ikBL3F","393216:ikBL3Fc","393216:kBL3Fcc","393216:BL3FccX","393216:L3FccXm","393216:3FccXm2","393216:FccXm2H","393216:ccXm2Hn","393216:cXm2Hnz","393216:Xm2Hnze","393216:m2Hnzes","393216:2Hnzesf","393216:Hnzesf/","393216:nzesf/2","393216:zesf/2H","393216:esf/2HB","393216:sf/2HB7","393216:f/2HB7w","393216:/2HB7wM","393216:2HB7wM+","393216:HB7wM+2","393216:B7wM+2E","393216:7wM+2EQ","393216:wM+2EQ6","393216:M+2EQ6L","393216:+2EQ6Lz","393216:2EQ6LzT","393216:EQ6LzT/","393216:Q6LzT/X","196608:1Vljnze","196608:Vljnzes","196608:ljnzesf","196608:jnzesf/","196608:nzesf/Q","196608:zesf/Q7","196608:esf/Q7w","196608:sf/Q7wQ","196608:f/Q7wQO","196608:/Q7wQOL","196608:Q7wQOLz","196608:7wQOLzT","196608:wQOLzT/","196608:QOLzT/X"],"imphash":"Unknown"},"file_info":{"file_name":"rvtools4.8.1.msi(NE PAS INSTALLER, ILLEGITIME)","file_type":["msi","data"],"file_type_id":"msi","file_size":10654208,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1785191881000,"last_seen":1785191881000,"last_multi_scan":1785191881000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":19},"sandbox_signatures":{"informative_count":40,"suspicious_count":2,"malicious_count":0,"total":42},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote user information"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"'3bNOid\" (Indicator: \"Oid\"; File: \"rvtools4.8.1.msi(NE PAS INSTALLER, ILLEGITIME)\"), file/memory contains long string with (Indicator: \"Aes\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\"), file/memory contains long string with (Indicator: \"Oid\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\"), file/memory contains long string with (Indicator: \"RC2\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - ['HH:mm:ss.SSSS'\n /\\d\\:\\d\\d\\.\\d+/]\n; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found string - egex = /^(-|\\+)?(?:(\\d*)[. ])?(\\d+):(\\d+)(?::(\\d+)(\\.\\d*)?)?$/\n; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.92955","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"MSI511D.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$24","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72AC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 16670000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 176F0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F30000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76E10000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76E10000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F30000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E0320000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 17940000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77A50000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77A50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"rvtools4.8.1.msi(NE PAS INSTALLER, ILLEGITIME)\" was detected as \"Microsoft Compound\" and name: \"Archive\"\n \"rvtools4.8.1.msi(NE PAS INSTALLER, ILLEGITIME)\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$25","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00006392)\n Spawned process \"msiexec.exe\" with commandline \"/i \"%LOCALAPPDATA%\\\\SampleCorp\\\\SampleApp\\\\rvtools4.8.1.msi\"\" (UID: 00000000-00007444)\n Spawned process \"MSI511D.tmp\" (UID: 00000000-00007008)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 9ACE27D97C720C5B4CC9FBCA7A8F2DD2 C\" (UID: 00000000-00005400)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00006392)\n Spawned process \"msiexec.exe\" with commandline \"/i \"%LOCALAPPDATA%\\\\SampleCorp\\\\SampleApp\\\\rvtools4.8.1.msi\"\" (UID: 00000000-00007444)\n Spawned process \"MSI511D.tmp\" (UID: 00000000-00007008)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 9ACE27D97C720C5B4CC9FBCA7A8F2DD2 C\" (UID: 00000000-00005400)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"finger\" (Indicator: \"finger\") in Source: 00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"rsa2\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"route\" (Indicator: \"route\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007008.00000000.182011.9ADF9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\SysWOW64\\msiexec.exe\" launched with commandline \"/i \"%LOCALAPPDATA%\\\\SampleCorp\\\\SampleApp\\\\rvtools4.8.1.msi\"\" (UID: 00000000-00007444)\n Process \"%WINDIR%\\Installer\\MSI511D.tmp\" launched with commandline \"\" (UID: 00000000-00007008)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\Installer\\MSI511D.tmp\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":88,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"6a67ddc7ce18ce0b4e00a0c9","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"rvtools4.8.1.msi(NE PAS INSTALLER, ILLEGITIME)","analysis_start_time":"2026-07-27T22:38:01+00:00","indicators_count":{"informative":40,"suspicious":2,"malicious":0},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a67ddc7ce18ce0b4e00a0c9"}],"processes":[{"pid":8084,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\rvtools4.8.1.msi_NEPASINSTALLER_ILLEGITIME_.msi\"","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00008084","icon":"$29"},{"pid":6392,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00006392","icon":"$2a"},{"pid":7444,"ppid":6392,"name":"msiexec.exe","command_line":"/i \"%LOCALAPPDATA%\\SampleCorp\\SampleApp\\rvtools4.8.1.msi\"","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\SysWOW64\\msiexec.exe","parent_uid":"00000000-00006392","uid":"00000000-00007444"},{"pid":7008,"ppid":6392,"name":"MSI511D.tmp","command_line":"","sha256":"1f33a47299d426dc65b57d5b285b543dcb8bd38fa7aba918243ec94795a890af","normalized_path":"%WINDIR%\\Installer\\MSI511D.tmp","parent_uid":"00000000-00006392","uid":"00000000-00007008"},{"pid":5400,"ppid":6392,"name":"MsiExec.exe","command_line":"-Embedding 9ACE27D97C720C5B4CC9FBCA7A8F2DD2 C","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00006392","uid":"00000000-00005400"}],"all_imported_dlls":["mscoreei.dll","cabinet.dll","wow64base.dll","msvcp_win.dll","coml2.dll","CoreMessaging.dll","VxSSL32.dll","dwmapi.dll","usp10.dll","kernel32.dll","ucrtbase.dll","comctl32.dll","bcrypt.dll","bcryptprimitives.dll","WinTypes.dll","vcruntime140_1_clr0400.dll","WindowsCodecs.dll","AcLayers.dll","advapi32.dll","setupapi.dll","msls31.dll","gdi32full.dll","combase.dll","sfc_os.dll","uxtheme.dll","fusion.dll","ServicingCommon.dll","wow64.dll","wow64cpu.dll","sechost.dll","VxSSL64.dll","msctf.dll","TextShaping.dll","windows.storage.dll","vcruntime140_clr0400.dll","RstrtMgr.dll","riched20.dll","msihnd.dll","kernel.appcore.dll","profapi.dll","mpr.dll","srclient.dll","apphelp.dll","oleaut32.dll","mscoree.dll","pcacli.dll","vssapi.dll","ntdll.dll","imm32.dll","shell32.dll","netutils.dll","userenv.dll","vsstrace.dll","ucrtbase_clr0400.dll","shlwapi.dll","gdi32.dll","vcruntime140.dll","version.dll","sfc.dll","wow64con.dll","wldp.dll","oleacc.dll","msvcrt.dll","rpcrt4.dll","user32.dll","msvcp140.dll","umpdc.dll","ole32.dll","ws2_32.dll","TextInputFramework.dll","spp.dll","powrprof.dll","clr.dll","ncrypt.dll","wow64win.dll","KernelBase.dll","win32u.dll","msi.dll","srpapi.dll","wkscli.dll","clbcatq.dll","sspicli.dll","ntasn1.dll","fltLib.dll","vcruntime140_1.dll","propsys.dll","SHCore.dll","netapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6a67ddc7ce18ce0b4e00a0c9"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 4bb5874756ee… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 4bb5874756ee…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd"}],["$","meta","4",{"property":"og:title","content":"Sample 4bb5874756ee… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 4bb5874756ee…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 4bb5874756ee… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 4bb5874756ee…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]