35:"ReportDetailWrapper" 36:I[10321,["$1","$2","$3","$4","$5","$8","$9","$a"],"$35"] 215:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 34:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 687964e436f0… — Score 75/100 — Sample 55d2b5ae5929…","description":"Malicious verdict for sandbox report 687964e436f0…. Threat score 75/100. 1 malicious and 17 suspicious behavioral indicators across 254 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/55d2b5ae592975bb6fea4c20c43c09d4f37d04d75fac7531da449d33d296c037/687964e436f0bdb80103f15d","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","55d2b5ae592975bb6fea4c20c43c09d4f37d04d75fac7531da449d33d296c037"],"about":{"@type":"SoftwareApplication","name":"AutoTCrypto Desktop.exe","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections","identifier":"55d2b5ae592975bb6fea4c20c43c09d4f37d04d75fac7531da449d33d296c037","additionalType":"Malicious sample"},"threatScore":75,"sandboxEnvironment":"Windows 11 64 bit","behavioralIndicators":{"malicious":1,"suspicious":17,"totalSignatures":254},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}37:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAIiIiIiAAAAAAAAAAAAAAIiI///4iIAAAAAAAAAAAAiI//////iIAAAAAAAAAACI////////+IAAAAAAAAAIj/////////+IAAAAAAAACI//////////iAAAAAAAAIj///////////iAAAd3d3eI////iIiP///4gAAHd3d3j///+IgIiP///4AAAAAHcI////iAAIj///+AAAAAB3CP///4gACI////gAAAAAdwj///+IAAiP///4AAAAAHcI////+IiIj///+Hd3d3d3eI////iIiP///4h///////+P//////////+If3d3d3d3iP/////////4gH93d3d3d3j/////////+IB/d3d3d3d3j////////4gAf3d3d3d3d3iP/////4iAAH93d3d3d3d3iI///4iIAAB/d3d3d3d3d3eIiIiIAAAAf3d3d3d3d3d3d3f3AAAAAH93d3d3d3d3d3d39wAAAAB/d3d3d3d3d3d3d/cAAAAAf3d3d3d3d3d3d3f3AAAAAH93d3d3d3d3d3d39wAAAAB/d3d3d3d3d3d3d/cAAAAAf3d3d3d3d3d3d3f3AAAAAH93d3d3d3d3d3d39wAAAAB///////////////cAAAAAd3d3d3d3d3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAD//4A///4AD//8AAf/+AAD//AAAf/wAAH/4AAA8AAAAPAABAD/IA4A/yAOAP8gDgD/IAAAAAAAAAAAAAAAAAABAAAAAQAAAAMAAAAHAAAADwAAAD8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD//////w==38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAIiIiIiAAAAAAAAAAAAAAIiI///4iIAAAAAAAAAAAAiI//////iIAAAAAAAAAACI////////+IAAAAAAAAAIj/////////+IAAAAAAAACI//////////iAAAAAAAAIj///////////iAAAd3d3eI////iIiP///4gAAHd3d3j///+IgIiP///4AAAAAHcI////iAAIj///+AAAAAB3CP///4gACI////gAAAAAdwj///+IAAiP///4AAAAAHcI////+IiIj///+Hd3d3d3eI////iIiP///4h///////+P//////////+If3d3d3d3iP/////////4gH93d3d3d3j/////////+IB/d3d3d3d3j////////4gAf3d3d3d3d3iP/////4iAAH93d3d3d3d3iI///4iIAAB/d3d3d3d3d3eIiIiIAAAAf3d3d3d3d3d3d3f3AAAAAH93d3d3d3d3d3d39wAAAAB/d3d3d3d3d3d3d/cAAAAAf3d3d3d3d3d3d3f3AAAAAH93d3d3d3d3d3d39wAAAAB/d3d3d3d3d3d3d/cAAAAAf3d3d3d3d3d3d3f3AAAAAH93d3d3d3d3d3d39wAAAAB///////////////cAAAAAd3d3d3d3d3d3d3d3AAAAAAAAAAAAAAAAAAAAAAAAAAD//4A///4AD//8AAf/+AAD//AAAf/wAAH/4AAA8AAAAPAABAD/IA4A/yAOAP8gDgD/IAAAAAAAAAAAAAAAAAABAAAAAQAAAAMAAAAHAAAADwAAAD8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD//////w==39:T552,"AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090496'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090560'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090480'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090416'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '1933508608', 'hResInfo': '1936058616'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '128516098', 'hResInfo': '128583184'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '167051265', 'hResInfo': '128845016'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '167051265', 'hResInfo': '167117384'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19314896'}" (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19314832'}" (UID: 00000000-00007824)3a:T49c,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "AutoTCrypto Desktop.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "AutoTCrypto Desktop.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "AutoTCrypto Desktop.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "AutoTCrypto Desktop.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "AutoTCrypto Desktop.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "AutoTCrypto Desktop.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "AutoTCrypto Desktop.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "AutoTCrypto Desktop.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "AutoTCrypto Desktop.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "AutoTCrypto Desktop.exe")3b:Tbce,Found string - \\.\pipe\ToServer; Source: "AutoTCrypto Desktop.exe") Found string - \\.\pipe\ToServerAdvinst_Extract_C:\AutoTCryptoDesktop.exe; Source: "00000000-00007824-00000C57-2367323232") Found string - \\.\DISPLAY1; Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.09575000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp") Found string - \\.\DI; Source: "00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp")3c:T2aa0,"AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000011777803a7007803a700000000000950117700007576030000000651117700000000c8f06f0034293b750000000000000000000000000000000020483b7508000000000000005013797634293b7500000000080000007803a700000000000000000000000000000000001800000092dad8cb239b9273e0016f00acf06f0040f16f00c0c89273d68823b8feffffff94fc1577e00ca7000000a600000000000000000083989173b4f06f00000000006400000010000f004051a600000000000f00000000000000600aa700df0ca700e00ca7003051a6000000a600acf06f0094f06f00a6eb1177000000000000000000000000b0473b753f7e38e1ccf06f00 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000a6000a0000000b00000038000000d0077a0000007a00000000000000000000077a00703ba80020000000f4fb6f00307af1000000000000f05b003819a800200000000cfc6f00807af1000000000000f05b003819a80000821a0104fc6f0006f21201d80c260140fc6f001e14130102000000fd13130137696f5a807af100c8941a0100f05b000000000014fc6f00aa161301dcfc6f00b0f3110107e8255bfeffffff68fc6f00aa1613015cfc6f0054fc6f0060fc6f0070fc6f0074fc6f00020000000200000031b8100178fc6f000e1613011c10260100821a0184fc6f004bbb110100821a0190fc6f006fbb110100821a01a8fc6f00947af100 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000a600b42f5c00a0eb6f00650916771200000000000000d06cc77502000000d08ba600b42f5c00c0eb6f00650916771200000000000000d06cc775f0b9107612000000d4eb6f00ae2e13770200000000000000d06cc775e4eb6f00e16cc77502000000000000000cec6f006820a57602000000000000007f29591b70921876000000004cec6f00201baa76ffffffff5cec6f005810a5763c10a5762f29591b709218769cb91076f0b910763cec6f0038ec6f000d0000000d000000504134767cc86d76000000004041347658ec6f00d0ec6f00608da8763bd0876dfeffffff68ec6f00900fa5765041347678ec6f00062527767cc86d765041347684ec6f00 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000006f00c656117708ec6f0000000000e86ba70000000000e86ba7000074137708ec6f0000000000e86ba700a0ec6f00ec7413770c6ca700ecec6f00000000002f7513777a6f4773780000000000000028020000000000007a6f4773000000002e003f73b8ec6f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a103000000000000000000000080000000000000000000000000000000000000000000000000000028020000000000007a6f4773000000002e003f73b8ec6f00b02511770f6238e1b4ec6f0080731377e30100003d0000007a6f4773f4ec6f00 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000ff6238e190eb6f005072a80090ee6f00b0e81477b7be4996feffffff5072a800787f1277c066a800000000005072a8000a000b00b6c73173000000000000000060a6317370a631735072a8008070a800140000000000000000000000c066a80000000000c0ec6f00d70811775072a800000000008403fe7f00000000f0002a7300000000094d0b3dec6114775fd61077640200005072a80000000000ec66a800180000000000000048ed6f0040080000000000000000000000000000010000003d13bd5044ed6f00350100c0e466a8001ced6f0030a13073feffffff48ed6f00000000000000000000000000640200002ced6f00 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000007a0014000000000000000000a60004087a007b23718f4f5338e10000380030df7e8a20de6f00b0e8147747a34996feffffff30de6f001068a6000000b47530fa9772d4471177c54711779f5038e10000000080c39872a6a271cf24de6f00b4e06f00b0acac72ffffffff64de6f0072fa9772b4e06f007cce897272fa97720100000000000000020000007cce897298de6f000000000080c3987280fa977200000000c0e06f007c0bc97510aad575f2a271cf (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006f00c0c89273d68823b8feffffff9cda6f007e62917330da6f002af0d8cbffffffff00000000e762917301000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffd6a671cf74da6f00c0dd6f00b0acac72ffffffffb4da6f0072fa9772b1ca11777cce897272fa97720100000000000000020000007cce8972e0da6f001ce16f0034f6a90080fa9772f4da6f0040000000d0077a000000000022a671cf (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000130068f4a8007cf4a80020000000d0077a0000007a0020000000000000000000a600183ea8000000000000000000000000000200000020000000c8017a00000000000400000000007a0012000000000000000000a60096a171cf34dd6f00c8dd6f00b0acac72ffffffff70dd6f0072fa9772120000007cce897272fa97720100000000000000020000007cce89729cdd6f002c3daa000000000080fa977210000000fcffffff0000000070dd6f00 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006f0068ce6f0074ce6f0064ce6f0002020000a0ce6f00b005a67542d26f009002a675c105a67514d26f00ffffffffd8ce6f00dcce6f000000000068ce6f00be391177287ba900000000000000000000000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f000c7daa0080fa9772a294c6752900000090b4a70000000000dab271cf (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000ec02a60018ce6f000cd06f000000a600000000000000000000000000000000000000000000000000200000000d000800a837aa00d03aaa00b1ca1177d03aaa00000000002800000042009d728ccf6f00000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f003c81aa0080fa9772a294c6752a00000090b1a70000000000dab271cf (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c000000de7faa0034d06f00caff0f77de7faa0028ce6f005c000000c07faa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f007c82aa0080fa9772a294c67526000000d884aa0000000000dab271cf (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000001177e74138e100100000081000000000a60031006f00574338e174cd6f00d4cd6f009ce26f005c0000004f00004f34d06f00caff0f770699aa0028ce6f005c00000002000002d8d06f00541f004b00000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f00ecc5aa0080fa9772a294c6752900000038bfaa0000000000dab271cf (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c0000002e83aa0034d06f00caff0f772e83aa0028ce6f005c0000001083aa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f00ecc5aa0080fa9772a294c675270000005089aa0000000000dab271cf (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c0000002e83aa0034d06f00caff0f772e83aa0028ce6f005c0000001083aa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f002cd4aa0080fa9772a294c6752a00000078bbaa0000000000dab271cf (UID: 00000000-00007824)3d:T10d0,"AutoTCryptoDesktop.exe" queries volume information of "C:\" at 00000000-00007824-00000C17-2370475691 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_close_down.png" at 00000000-00007824-00000C17-2371975750 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_close_hot.png" at 00000000-00007824-00000C17-2371988091 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_close_hot.png" at 00000000-00007824-00000C17-2371990872 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_close_normal.png" at 00000000-00007824-00000C17-2371993800 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_close_inactive.png" at 00000000-00007824-00000C17-2371996633 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_min_down.png" at 00000000-00007824-00000C17-2371999690 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_min_hot.png" at 00000000-00007824-00000C17-2372002403 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_min_hot.png" at 00000000-00007824-00000C17-2372005099 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_min_normal.png" at 00000000-00007824-00000C17-2372007969 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\sys_min_inactive.png" at 00000000-00007824-00000C17-2372010758 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_top_left.bmp" at 00000000-00007824-00000C17-2372013716 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_top_left_inactive.bmp" at 00000000-00007824-00000C17-2372016969 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_top_mid.bmp" at 00000000-00007824-00000C17-2372019836 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_top_mid_inactive.bmp" at 00000000-00007824-00000C17-2372022871 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_caption.bmp" at 00000000-00007824-00000C17-2372026610 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_caption_inactive.bmp" at 00000000-00007824-00000C17-2372029539 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_top_right.bmp" at 00000000-00007824-00000C17-2372032619 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_top_right_inactive.bmp" at 00000000-00007824-00000C17-2372035593 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_left.bmp" at 00000000-00007824-00000C17-2372038656 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_left_inactive.bmp" at 00000000-00007824-00000C17-2372041474 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_right.bmp" at 00000000-00007824-00000C17-2372044255 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_right_inactive.bmp" at 00000000-00007824-00000C17-2372047346 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_bottom_left.bmp" at 00000000-00007824-00000C17-2372050425 "AutoTCryptoDesktop.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_7824\frame_bottom_left_inactive.bmp" at 00000000-00007824-00000C17-23720534323e:T974,"AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")3f:T5d7,"AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "AutoTCryptoDesktop.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")40:T2dce,"AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\psapi.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\WindowsCodecs.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msi.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USP10.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msls31.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\mpr.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\profapi.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\gdiplus.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\userenv.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwmapi.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\davhlpr.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\oleaut32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\comctl32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\gdi32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\user32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\comdlg32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msimg32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dbghelp.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wininet.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\urlmon.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cabinet.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\propsys.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\rsaenh.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\apphelp.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msasn1.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wintrust.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\lpk.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\setupapi.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\usp10.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msihnd.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shcore.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptsp.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\secur32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\samcli.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\netapi32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\netutils.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\srvcli.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wkscli.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RICHED20.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter \\?\%APPDATA%\Autotcrypto.com\AutoTCrypto Desktop 101.1.3\install\1033.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter ComCtl32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\VERSION.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\TSAPPCMP.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHLWAPI.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\WLDP.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ADVAPI32.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\APPHELP.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\sxs.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\MSCOREE.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\fusion.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHELL32.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\NTDLL.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter MsiHnd.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter KERNEL32 (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter DWMAPI (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\PCACLI.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\USER32.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RPCRT4.DLL (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007824) "AutoTCryptoDesktop.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00007824)41:Tcb2,"INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES ('" (Source: AutoTCrypto Desktop.exe, Indicator: "insert into `controlevent` (`dialog_`, `control_`,`event`,`argument`, `condition`, `ordering`) values ('") "INSERT INTO `Property` (`Property`, `Value`) VALUES (?, ?)" (Source: AutoTCrypto Desktop.exe, Indicator: "insert into `property` (`property`, `value`) values (?, ?)"), "SELECT `Component` FROM `Component`" (Source: AutoTCrypto Desktop.exe, Indicator: "select `component` from `component`"), "SELECT `Value` FROM `Property` WHERE Property='%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where property='%s'"), "UPDATE `Property` SET `Property`.`Value`=? WHERE Property=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `property` set `property`.`value`=? where property=?"), "UPDATE `Component` SET `Component`.`ComponentId`=? WHERE Component=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `component` set `component`.`componentid`=? where component=?"), "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `text` from `uitext` where `key` = '%s'"), "SELECT `Value` FROM `Property` WHERE `Property` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where `property` = '%s'"), "SELECT `Data` FROM `Binary` WHERE `Name` = 'Prereq.dll'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `data` from `binary` where `name` = 'prereq.dll'"), "SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0" (Source: AutoTCrypto Desktop.exe, Indicator: "select * from `installuisequence` where `sequence` > 0"), "SELECT `Dialog` `HCentering` `VCentering` `Width` `Height` `Attributes` `Title` `Control_First` `Control_Default` `Control_Cancel` 0 0 0 0 FROM `Dialog` WHERE `Dialog`=?" (Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, Indicator: "select `dialog` `hcentering` `vcentering` `width` `height` `attributes` `title` `control_first` `control_default` `control_cancel` 0 0 0 0 from `dialog` where `dialog`=?"), "SELECT `Dialog_` `Control_` `Event` `Argument` `Condition` FROM `ControlEvent` WHERE `Dialog_`='LanguageDlg' AND `Control_`='LangComboBox' ORDER BY `Ordering`" (Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, Indicator: "select `dialog_` `control_` `event` `argument` `condition` from `controlevent` where `dialog_`='languagedlg' and `control_`='langcombobox' order by `ordering`"), "SELECT * FROM `Error` WHERE Error = 15" (Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp, Indicator: "select * from `error` where error = 15"), "SELECT `Action` `Condition` `Sequence` FROM `BootstrapperUISequence` WHERE `Sequence` >= 0 ORDER BY `Sequence`" (Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp, Indicator: "select `action` `condition` `sequence` from `bootstrapperuisequence` where `sequence` >= 0 order by `sequence`")42:T5ab,"INSERT INTO `Property` (`Property`, `Value`) VALUES (?, ?)" (Source: AutoTCrypto Desktop.exe, Indicator: "insert into `property` (`property`, `value`) values (?, ?)"), "SELECT `Component` FROM `Component`" (Source: AutoTCrypto Desktop.exe, Indicator: "select `component` from `component`"), "SELECT `Value` FROM `Property` WHERE Property='%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where property='%s'"), "UPDATE `Property` SET `Property`.`Value`=? WHERE Property=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `property` set `property`.`value`=? where property=?"), "UPDATE `Component` SET `Component`.`ComponentId`=? WHERE Component=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `component` set `component`.`componentid`=? where component=?"), "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `text` from `uitext` where `key` = '%s'"), "SELECT `Value` FROM `Property` WHERE `Property` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where `property` = '%s'"), "SELECT `Data` FROM `Binary` WHERE `Name` = 'Prereq.dll'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `data` from `binary` where `name` = 'prereq.dll'"), "SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0" (Source: AutoTCrypto Desktop.exe, Indicator: "select * from `installuisequence` where `sequence` > 0"), "SELECT `Dialog`43:T5ab,"INSERT INTO `Property` (`Property`, `Value`) VALUES (?, ?)" (Source: AutoTCrypto Desktop.exe, Indicator: "insert into `property` (`property`, `value`) values (?, ?)"), "SELECT `Component` FROM `Component`" (Source: AutoTCrypto Desktop.exe, Indicator: "select `component` from `component`"), "SELECT `Value` FROM `Property` WHERE Property='%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where property='%s'"), "UPDATE `Property` SET `Property`.`Value`=? WHERE Property=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `property` set `property`.`value`=? where property=?"), "UPDATE `Component` SET `Component`.`ComponentId`=? WHERE Component=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `component` set `component`.`componentid`=? where component=?"), "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `text` from `uitext` where `key` = '%s'"), "SELECT `Value` FROM `Property` WHERE `Property` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where `property` = '%s'"), "SELECT `Data` FROM `Binary` WHERE `Name` = 'Prereq.dll'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `data` from `binary` where `name` = 'prereq.dll'"), "SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0" (Source: AutoTCrypto Desktop.exe, Indicator: "select * from `installuisequence` where `sequence` > 0"), "SELECT `Dialog`44:Ta34c,Found reference to API (Indicator: "GetStdHandle"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CloseHandle"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EncodePointer"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetLastError"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DeleteFileW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateEventW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalFree"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFileType"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetTempPathW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CopyFileExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateProcessW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WriteFile"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "lstrcmpW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateNamedPipeW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LoadResource"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TlsFree"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LockResource"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RaiseException"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateFileW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DecodePointer"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FreeLibrary"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ResetEvent"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalLock"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MulDiv"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSystemTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "Process32NextW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFileSize"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RtlUnwind"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetLocalTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OpenEventW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CopyFileW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetFileTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VirtualFree"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ExitThread"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FindNextFileW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsValidLocale"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "Process32FirstW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EnumResourceLanguagesW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCPInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "HeapSize"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "Sleep"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FindClose"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetStdHandle"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetVersionExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VirtualQuery"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TlsAlloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsWow64Process"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SizeofResource"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetTickCount"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "HeapDestroy"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "HeapAlloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetProcAddress"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FormatMessageW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CompareStringW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetOEMCP"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CompareStringEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TerminateThread"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "HeapFree"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetEvent"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ReadFile"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TlsSetValue"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "lstrcpynW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LCMapStringW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TerminateProcess"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LocalAlloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FindResourceExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CompareFileTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetACP"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFileTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LocalFree"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FindResourceW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TlsGetValue"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateThread"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetFilePointer"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VirtualProtect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateEventExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetLastError"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "lstrlenW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MoveFileW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ExitProcess"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FlsAlloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FlsFree"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FlsGetValue"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FlsSetValue"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetSearchPathMode"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsWow64Process2"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ConvertStringSidToSidW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetKeyState"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ReleaseDC"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetDC"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InvalidateRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetClientRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FillRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetCapture"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MoveWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ScreenToClient"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetParent"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ClientToScreen"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DestroyWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LoadCursorW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RedrawWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetWindowPos"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CharNextW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSysColor"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetFocus"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFocus"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsChild"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "BeginPaint"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ShowWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetWindowRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetWindowDC"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LookupIconIdFromDirectoryEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateIconFromResourceEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "KillTimer"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetTimer"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EqualRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CopyRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MessageBoxW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SendMessageA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MessageBeep"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "PtInRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsRectEmpty"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IntersectRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DestroyIcon"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TranslateMessage"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "PeekMessageW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCursorPos"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetCursorPos"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EnableWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LoadImageW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetCursor"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DestroyCursor"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetWindowRgn"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsZoomed"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OffsetRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DrawIconEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LoadStringW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "AppendMenuW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DestroyMenu"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetScrollInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetScrollPos"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DrawEdge"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetScrollInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetScrollPos"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetCapture"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "UpdateWindow"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InflateRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetObjectW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetStockObject"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DeleteDC"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "BitBlt"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DeleteObject"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SelectObject"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreatePatternBrush"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegCloseKey"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "StringFromGUID2"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoGetClassObject"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OleUninitialize"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OleInitialize"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoInitialize"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoUninitialize"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoTaskMemRealloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "PathFileExistsW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "PathIsDirectoryW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "PathAddBackslashW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "PathAppendW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetCrackUrlW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetSetOptionW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetOpenW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetGetLastResponseInfoW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetReadFile"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FtpGetFileSize"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetQueryOptionW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "HttpQueryInfoW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InternetConnectW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "HttpOpenRequestW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "HttpSendRequestW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FtpOpenFileW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FtpCommandW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WNetAddConnection2W"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WNetGetUniversalNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EnumWindows"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "wsprintfW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ModifyMenuW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetIconInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EqualSid"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FreeSid"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LookupAccountNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LookupAccountSidW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "IsTextUnicode"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegEnumValueA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegCreateKeyW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetUserNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegDeleteKeyA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegCreateKeyA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegOpenKeyA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "NetLocalGroupGetInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "NetApiBufferFree"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MessageBox"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "MoveFile"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "RegOverridePredefKey"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OpenServiceW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "StartServiceW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LogonUserW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LsaClose"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "QueryServiceObjectSecurity"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "QueryServiceStatus"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EnumServicesStatusW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "InitializeSid"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LsaOpenPolicy"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LsaAddAccountRights"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ControlService"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SetServiceObjectSecurity"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetSidLengthRequired"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "LsaNtStatusToWinError"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CertGetNameStringW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetTcpTable"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OpenMutexW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "lstrcpyW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalAddAtomW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "lstrcatW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalFindAtomW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "OpenProcess"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "FormatMessageA"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "NetGetDCName"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "NetUserGetInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "NetQueryDisplayInformation"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "NetGroupGetInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "NetUserModalsGet"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SysAllocString"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VariantInit"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "VariantClear"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SysStringLen"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SysFreeString"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "DeleteMenu"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WSAStartup"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "htonl"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "gethostbyname"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "ntohs"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "WSACleanup"; File: "AutoTCrypto Desktop.exe") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00007824.00000000.215853.00A60000.00000004.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp")45:T1608,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "AutoTCrypto Desktop.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "AutoTCrypto Desktop.exe") Found reference to API "Could not update resource for file: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found reference to API "Error creating temp file on path: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found reference to API "Error converting file time to local time for file: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Patch file [2] is corrupt or of an invalid format. Attempting to patch file [3]. GetLastError: [4]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error getting file security: [3] GetLastError: [2]" (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error determining whether file is in-use: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Could not create thread for patch application. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error deleting file: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Could not open file: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Could not close file: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error getting volume info. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Could not apply patch to file [2]. GetLastError: [3]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error opening file for write: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Could not get file time for file: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Could not set file time for file: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error getting file attributes: [3]. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error opening file for read: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Could not remove directory: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error getting file attributes. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error setting file attribute: [3] GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error setting file attributes. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error waiting for patch thread. GetLastError: [2]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp") Found reference to API "Error getting disk free space. GetLastError: [2]. Volume: [3]." (Indicator: "GetLastError"; Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp")46:T83d,"ExternalUICleaner.dll" contains export function called "DoRemoveExternalUIStub" at ordinal 1 "ExternalUICleaner.dll" contains export function called "RemoveExternalUIStub" at ordinal 2 "lzmaextractor.dll" contains export function called "DeleteExtractionPath" at ordinal 1 "lzmaextractor.dll" contains export function called "DeleteLZMAFiles" at ordinal 2 "lzmaextractor.dll" contains export function called "ExpandExtractionPath" at ordinal 3 "lzmaextractor.dll" contains export function called "ExtractLZMAFiles" at ordinal 4 "lzmaextractor.dll" contains export function called "FindEXE" at ordinal 5 "MSIFA0B.tmp" contains export function called "AI_AuthorSinglePackage" at ordinal 1 "MSIFA0B.tmp" contains export function called "AI_ResolveKnownFolders" at ordinal 2 "MSIFA0B.tmp" contains export function called "AI_SearchOfficeAddins" at ordinal 3 "MSIFA0B.tmp" contains export function called "AddCaspolSecurityPolicy" at ordinal 4 "MSIFA0B.tmp" contains export function called "BrowseForFile" at ordinal 5 "MSIFA0B.tmp" contains export function called "CheckFreeTCPPort" at ordinal 6 "MSIFA0B.tmp" contains export function called "CheckIfUserExists" at ordinal 7 "MSIFA0B.tmp" contains export function called "ChooseTextStyles" at ordinal 8 "MSIFA0B.tmp" contains export function called "CloseApplication" at ordinal 9 "MSIFA0B.tmp" contains export function called "CollectFeaturesWithoutCab" at ordinal 10 "MSIFA0B.tmp" contains export function called "ComputeReplaceProductsList" at ordinal 11 "MSIFA0B.tmp" contains export function called "ConfigureNonAdminServiceStart" at ordinal 12 "MSIFA0B.tmp" contains export function called "ConfigureServFailActions" at ordinal 13 "MSIFA0B.tmp" contains export function called "CopyFileFolder" at ordinal 14 "MSIFA0B.tmp" contains export function called "CreateExeProcess" at ordinal 15 "MSIFA0B.tmp" contains export function called "DeleteEmptyDirectory" at ordinal 16 "MSIFA0B.tmp" contains export function called "DeleteFromCheckList" at ordinal 17 "MSIFA0B.tmp" contains export function called "DeleteFromComboBox" at ordinal 1847:T74a,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00007824.00000000.215853.00A60000.00000004.mdmp 00000000-00007824.00000001.217774.00A60000.00000004.mdmp 00000000-00007824.00000002.219693.00A60000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00007824.00000000.215853.00A60000.00000004.mdmp 00000000-00007824.00000001.217774.00A60000.00000004.mdmp 00000000-00007824.00000002.219693.00A60000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp 00000000-00007824.00000002.219693.0A970000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp 00000000-00007824.00000002.219693.0A970000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp 00000000-00007824.00000002.219693.0A970000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp 00000000-00007824.00000002.219693.0A970000.00000004.mdmp48:T894,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: AutoTCrypto Desktop.exe "Software\Caphyon\Advanced Installer\" in Source: AutoTCrypto Desktop.exe "Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\" in Source: AutoTCrypto Desktop.exe "Software\Microsoft\Internet Explorer\Settings" in Source: AutoTCrypto Desktop.exe "Software\JavaSoft\Java Development Kit\" in Source: AutoTCrypto Desktop.exe "Software\JavaSoft\Java Runtime Environment\" in Source: AutoTCrypto Desktop.exe "Software\Microsoft\Windows NT\CurrentVersion" in Source: AutoTCrypto Desktop.exe "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: AutoTCrypto Desktop.exe "Software\Caphyon\Setups" in Source: AutoTCrypto Desktop.exe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: AutoTCrypto Desktop.exe "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: AutoTCrypto Desktop.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\TempPackages" in Source: AutoTCrypto Desktop.exe "Software\Microsoft\Windows\CurrentVersion\Uninstall\[ProductName] [ProductVersion]" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp 00000000-00007824.00000002.219693.00A60000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp 00000000-00007824.00000001.217774.0A970000.00000004.mdmp 00000000-00007824.00000002.219693.00A60000.00000004.mdmp 00000000-00007824.00000002.219693.0A970000.00000004.mdmp "Software\Caphyon\Advanced Installer\[ProductCode]" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp 00000000-00007824.00000002.219693.00A60000.00000004.mdmp "Registry\Machine\Software\Classes\PROTOCOLS\Name-Space Handler" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp "Software\[Manufacturer]\[ProductName]" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp 00000000-00007824.00000002.219693.00A60000.00000004.mdmp "Software\Caphyon\Advanced Installer\LZMA\[ProductCode]\[ProductVersion]" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp 00000000-00007824.00000002.219693.00A60000.00000004.mdmp49:T78c,"AutoTCrypto Desktop.exe" was detected as "temporary EXE SFX" and name: "sfx" "AutoTCrypto Desktop.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AutoTCrypto Desktop.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AutoTCrypto Desktop.exe" was detected as "Microsoft Linker" and name: "Linker" "ExternalUICleaner.dll" was detected as "temporary EXE SFX" and name: "sfx" "ExternalUICleaner.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ExternalUICleaner.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ExternalUICleaner.dll" was detected as "Microsoft Linker" and name: "Linker" "1033.dll" was detected as "temporary EXE SFX" and name: "sfx" "1033.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1033.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1033.dll" was detected as "Microsoft Linker" and name: "Linker" "lzmaextractor.dll" was detected as "temporary EXE SFX" and name: "sfx" "lzmaextractor.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "lzmaextractor.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "lzmaextractor.dll" was detected as "Microsoft Linker" and name: "Linker" "AutoTCrypto Desktop.aiui" was detected as "temporary EXE SFX" and name: "sfx" "AutoTCrypto Desktop.aiui" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AutoTCrypto Desktop.aiui" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AutoTCrypto Desktop.aiui" was detected as "Microsoft Linker" and name: "Linker" "MSIFA0B.tmp" was detected as "temporary EXE SFX" and name: "sfx" "MSIFA0B.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MSIFA0B.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSIFA0B.tmp" was detected as "Microsoft Linker" and name: "Linker"4a:T69e,"INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES ('" (Source: AutoTCrypto Desktop.exe, Indicator: "insert into `controlevent` (`dialog_`, `control_`,`event`,`argument`, `condition`, `ordering`) values ('") "INSERT INTO `Property` (`Property`, `Value`) VALUES (?, ?)" (Source: AutoTCrypto Desktop.exe, Indicator: "insert into `property` (`property`, `value`) values (?, ?)"), "SELECT `Component` FROM `Component`" (Source: AutoTCrypto Desktop.exe, Indicator: "select `component` from `component`"), "SELECT `Value` FROM `Property` WHERE Property='%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where property='%s'"), "UPDATE `Property` SET `Property`.`Value`=? WHERE Property=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `property` set `property`.`value`=? where property=?"), "UPDATE `Component` SET `Component`.`ComponentId`=? WHERE Component=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `component` set `component`.`componentid`=? where component=?"), "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `text` from `uitext` where `key` = '%s'"), "SELECT `Value` FROM `Property` WHERE `Property` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where `property` = '%s'"), "SELECT `Data` FROM `Binary` WHERE `Name` = 'Prereq.dll'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `data` from `binary` where `name` = 'prereq.dll'"), "SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0" (Source: AutoTCrypto Desktop.exe, Indicator: "select * from `installuisequence` where `sequence` > 0")4b:T599,"INSERT INTO `Property` (`Property`, `Value`) VALUES (?, ?)" (Source: AutoTCrypto Desktop.exe, Indicator: "insert into `property` (`property`, `value`) values (?, ?)"), "SELECT `Component` FROM `Component`" (Source: AutoTCrypto Desktop.exe, Indicator: "select `component` from `component`"), "SELECT `Value` FROM `Property` WHERE Property='%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where property='%s'"), "UPDATE `Property` SET `Property`.`Value`=? WHERE Property=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `property` set `property`.`value`=? where property=?"), "UPDATE `Component` SET `Component`.`ComponentId`=? WHERE Component=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `component` set `component`.`componentid`=? where component=?"), "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `text` from `uitext` where `key` = '%s'"), "SELECT `Value` FROM `Property` WHERE `Property` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where `property` = '%s'"), "SELECT `Data` FROM `Binary` WHERE `Name` = 'Prereq.dll'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `data` from `binary` where `name` = 'prereq.dll'"), "SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0" (Source: AutoTCrypto Desktop.exe, Indicator: "select * from `installuisequence` where `sequence` > 0")4c:T599,"INSERT INTO `Property` (`Property`, `Value`) VALUES (?, ?)" (Source: AutoTCrypto Desktop.exe, Indicator: "insert into `property` (`property`, `value`) values (?, ?)"), "SELECT `Component` FROM `Component`" (Source: AutoTCrypto Desktop.exe, Indicator: "select `component` from `component`"), "SELECT `Value` FROM `Property` WHERE Property='%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where property='%s'"), "UPDATE `Property` SET `Property`.`Value`=? WHERE Property=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `property` set `property`.`value`=? where property=?"), "UPDATE `Component` SET `Component`.`ComponentId`=? WHERE Component=?" (Source: AutoTCrypto Desktop.exe, Indicator: "update `component` set `component`.`componentid`=? where component=?"), "SELECT `Text` FROM `UIText` WHERE `Key` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `text` from `uitext` where `key` = '%s'"), "SELECT `Value` FROM `Property` WHERE `Property` = '%s'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `value` from `property` where `property` = '%s'"), "SELECT `Data` FROM `Binary` WHERE `Name` = 'Prereq.dll'" (Source: AutoTCrypto Desktop.exe, Indicator: "select `data` from `binary` where `name` = 'prereq.dll'"), "SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0" (Source: AutoTCrypto Desktop.exe, Indicator: "select * from `installuisequence` where `sequence` > 0")4d:T439,"AutoTCryptoDesktop.exe" touched "Msi install server" (Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}") "AutoTCryptoDesktop.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{000C103E-0000-0000-C000-000000000046}\TREATAS") "AutoTCryptoDesktop.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "AutoTCryptoDesktop.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "AutoTCryptoDesktop.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "AutoTCryptoDesktop.exe" touched "MrtResourceManager Class" (Path: "HKCU\WOW6432NODE\CLSID\{DBCE7E40-7345-439D-B12C-114A11819A09}\TREATAS") "AutoTCryptoDesktop.exe" touched "UIAutomation Registrar Class" (Path: "HKCU\WOW6432NODE\CLSID\{6E29FABF-9977-42D1-8D0E-CA7E61AD87E6}\TREATAS") "AutoTCryptoDesktop.exe" touched "PSOAInterface" (Path: "HKCU\WOW6432NODE\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS")4e:Tcee,"AutoTCrypto Desktop.exe" file has an entrypoint instructions - "call 0x60c7db,jmp 0x60c022,push ebp,mov ebp, esp,and dword ptr [0x750bac], 0,sub esp, 0x24,or dword ptr [0x74d020], 1,push 0xa,call dword ptr [0x699268],test eax, eax,je 0x60c37a,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20],mov dword ptr [ebp - 0xc], eax,xor edi, 0x756e6547,mov eax, dword ptr [ebp - 0x18]," "ExternalUICleaner.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000974e,call 0x10009aac,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000960a,add esp, 0xc,pop ebp,ret 0xc,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x10044040],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc]," "1033.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "lzmaextractor.dll" file has an entrypoint instructions - "mov eax, 1,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub esp, 0x450,push ebx,lea eax, [esp + 4],mov dword ptr [esp + 4], 0x104,push eax,lea eax, [esp + 0x250],mov bl, dl,push eax,push 0x10002078,push ecx,call dword ptr [0x10002050],test eax, eax,jne 0x1000112f,push esi,lea eax, [esp + 0x48],mov edx, 0x1000209c,mov esi, eax,mov ecx, 0x20,sub edx, esi,pop esi,mov word ptr [eax], cx,add eax, 2,movzx ecx, word ptr [edx + eax],test cx, cx," "AutoTCrypto Desktop.aiui" file has an entrypoint instructions - "call 0x60c7db,jmp 0x60c022,push ebp,mov ebp, esp,and dword ptr [0x750bac], 0,sub esp, 0x24,or dword ptr [0x74d020], 1,push 0xa,call dword ptr [0x699268],test eax, eax,je 0x60c37a,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20],mov dword ptr [ebp - 0xc], eax,xor edi, 0x756e6547,mov eax, dword ptr [ebp - 0x18]," "MSIFA0B.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1004e1ae,call 0x1004e4ef,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1004e06a,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 0xf,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x1004e5d0,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 7,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x1004e5d0,mov ecx, dword ptr [ebp - 0xc],"4f:Ta25,"AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ".") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "..") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "0409") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ADVANCEDINSTALLERS") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPLOCKER") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BESTPRACTICES") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BTHPROPS") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "COM") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIG") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIGURATION") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DIAGSVCS") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DISM") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DOWNLEVEL") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRIVERS") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRIVERSTORE") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "F12") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FXSTMP") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "GROUPPOLICY") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "GROUPPOLICYUSERS") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ICSXML") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IME") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "INETSRV") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "INPUTMETHOD") "AutoTCryptoDesktop.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "INSTALLSHIELD")50:Tb2f,Observed system executable string:"%WINDIR%\system32\psapi.dll" [Source: 00000000-00007824-00000C2A-2363506846] Observed system executable string:"%WINDIR%\system32\WindowsCodecs.dll" [Source: 00000000-00007824-00000C2A-2363535215] Observed system executable string:"%WINDIR%\system32\bcrypt.dll" [Source: 00000000-00007824-00000C2A-2363564091] Observed system executable string:"%WINDIR%\system32\msi.dll" [Source: 00000000-00007824-00000C2A-2363661023] Observed system executable string:"%WINDIR%\system32\USP10.dll" [Source: 00000000-00007824-00000C2A-2363758340] Observed system executable string:"%WINDIR%\system32\msls31.dll" [Source: 00000000-00007824-00000C2A-2363791505] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007824-00000C2A-2363821942] Observed system executable string:"%WINDIR%\system32\mpr.dll" [Source: 00000000-00007824-00000C2A-2363875124] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00007824-00000C2A-2363975385] Observed system executable string:"%WINDIR%\system32\profapi.dll" [Source: 00000000-00007824-00000C2A-2364006893] Observed system executable string:"%WINDIR%\system32\gdiplus.dll" [Source: 00000000-00007824-00000C2A-2364038033] Observed system executable string:"%WINDIR%\system32\userenv.dll" [Source: 00000000-00007824-00000C2A-2364069162] Observed system executable string:"%WINDIR%\system32\dwmapi.dll" [Source: 00000000-00007824-00000C2A-2364100609] Observed system executable string:"%WINDIR%\system32\davhlpr.dll" [Source: 00000000-00007824-00000C2A-2364130467] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00007824-00000C2A-2364162793] Observed system executable string:"%WINDIR%\system32\oleaut32.dll" [Source: 00000000-00007824-00000C2A-2364192759] Observed system executable string:"%WINDIR%\system32\comctl32.dll" [Source: 00000000-00007824-00000C2A-2364259143] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00007824-00000C2A-2364289607] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007824-00000C2A-2364317552] Observed system executable string:"%WINDIR%\system32\gdi32.dll" [Source: 00000000-00007824-00000C2A-2364344960] Observed system executable string:"%WINDIR%\system32\user32.dll" [Source: 00000000-00007824-00000C2A-2364380994] Observed system executable string:"%WINDIR%\system32\comdlg32.dll" [Source: 00000000-00007824-00000C2A-2364433199] Observed system executable string:"%WINDIR%\system32\msimg32.dll" [Source: 00000000-00007824-00000C2A-2364463996] Observed system executable string:"%WINDIR%\system32\dbghelp.dll" [Source: 00000000-00007824-00000C2A-2364496734] Observed system executable string:"%WINDIR%\system32\wininet.dll" [Source: 00000000-00007824-00000C2A-2364556481]51:T4435,"AutoTCrypto Desktop.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Code page: 1252 Title: Installation Database Subject: AutoTCrypto Desktop Author: Autotcrypto.com Keywords: Installer MSI Database Comments: autotcrypto.com Create Time/Date: Fri Aug 30 11:00:20 2024 Name of Creating Application: AutoTCrypto Desktop Security: 0 Template: ;1065 Last Saved By: ;1033 Revision Number: {E75096F1-6C4B-426F-8E87-7D68B81655E9}101.1.3;{E75096F1-6C4B-426F-8E87-7D68B81655E9}101.1.3;{0426815D-EE79-406C-8760-EDBE60E4A13F} Number of Pages: 450 Number of Characters: 63"- Location: [%APPDATA%\Autotcrypto.com\AutoTCrypto Desktop 101.1.3\install\AutoTCrypto Desktop.msi]- [targetUID: 00000000-00007824] "ExternalUICleaner.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\AI_EXTUI_BIN_7824\ExternalUICleaner.dll]- [targetUID: 00000000-00007824] "1033.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections"- Location: [%APPDATA%\Autotcrypto.com\AutoTCrypto Desktop 101.1.3\install\1033.dll]- [targetUID: 00000000-00007824] "lzmaextractor.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\AI_EXTUI_BIN_7824\lzmaextractor.dll]- [targetUID: 00000000-00007824] "AutoTCrypto Desktop.aiui" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%APPDATA%\Autotcrypto.com\AutoTCrypto Desktop 101.1.3\install\AutoTCrypto Desktop.aiui]- [targetUID: 00000000-00007824] "MSIFA0B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "background" has type "PC bitmap Windows 3.x format 462 x 573 x 8 cbSize 266950 bits offset 1078"- Location: [%TEMP%\AI_EXTUI_BIN_7824\background]- [targetUID: 00000000-00007824] "icon.png" has type "PNG image data 512 x 512 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\icon.png]- [targetUID: 00000000-00007824] "removico" has type "MS Windows icon resource - 5 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\removico]- [targetUID: 00000000-00007824] "custicon" has type "MS Windows icon resource - 5 icons 48x48 8 bits/pixel 32x32 8 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\custicon]- [targetUID: 00000000-00007824] "repairic" has type "MS Windows icon resource - 4 icons 48x48 8 bits/pixel 32x32 8 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\repairic]- [targetUID: 00000000-00007824] "PrepareDlgProgress.gif" has type "GIF image data version 89a 83 x 28"- Location: [%TEMP%\AI_EXTUI_BIN_7824\PrepareDlgProgress.gif]- [targetUID: 00000000-00007824] "installlogoicon" has type "MS Windows icon resource - 5 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\installlogoicon]- [targetUID: 00000000-00007824] "New" has type "MS Windows icon resource - 3 icons 48x48 32 bits/pixel 32x32 32 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\New]- [targetUID: 00000000-00007824] "insticon" has type "MS Windows icon resource - 3 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\insticon]- [targetUID: 00000000-00007824] "Up" has type "MS Windows icon resource - 3 icons 48x48 32 bits/pixel 32x32 32 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\Up]- [targetUID: 00000000-00007824] "optionslogoicon" has type "MS Windows icon resource - 3 icons 48x48 8 bits/pixel 48x48 32 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\optionslogoicon]- [targetUID: 00000000-00007824] "completi" has type "MS Windows icon resource - 2 icons 48x48 8 bits/pixel 48x48 32 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\completi]- [targetUID: 00000000-00007824] "waitlogoicon" has type "MS Windows icon resource - 2 icons 48x48 8 bits/pixel 48x48 32 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\waitlogoicon]- [targetUID: 00000000-00007824] "repair.png" has type "PNG image data 732 x 163 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\repair.png]- [targetUID: 00000000-00007824] "remove.png" has type "PNG image data 732 x 163 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\remove.png]- [targetUID: 00000000-00007824] "printico" has type "MS Windows icon resource - 2 icons 32x32 8 bits/pixel 32x32 32 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\printico]- [targetUID: 00000000-00007824] "metrorunapplicationbutton" has type "PNG image data 732 x 163 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\metrorunapplicationbutton]- [targetUID: 00000000-00007824] "viewreadmebutton" has type "PNG image data 732 x 163 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\viewreadmebutton]- [targetUID: 00000000-00007824] "runapplicationbutton" has type "PNG image data 432 x 72 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\runapplicationbutton]- [targetUID: 00000000-00007824] "cmdlinkarrow" has type "MS Windows icon resource - 3 icons 16x16 16 colors 4 bits/pixel 16x16 8 bits/pixel"- Location: [%TEMP%\AI_EXTUI_BIN_7824\cmdlinkarrow]- [targetUID: 00000000-00007824] "modify.png" has type "PNG image data 732 x 163 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\modify.png]- [targetUID: 00000000-00007824] "info" has type "PNG image data 50 x 69 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\info]- [targetUID: 00000000-00007824] "nextcancelbuttons.xaml" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\nextcancelbuttons.xaml]- [targetUID: 00000000-00007824] "ProgressImage.png" has type "PNG image data 121 x 14 8-bit/color RGB non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\ProgressImage.png]- [targetUID: 00000000-00007824] "metroinstallbutton.xaml" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\metroinstallbutton.xaml]- [targetUID: 00000000-00007824] "exclamic" has type "PNG image data 50 x 69 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\exclamic]- [targetUID: 00000000-00007824] "whitebackground" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 400x300 components 3"- Location: [%TEMP%\AI_EXTUI_BIN_7824\whitebackground]- [targetUID: 00000000-00007824] "print.png.xaml" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\print.png.xaml]- [targetUID: 00000000-00007824] "repair.png.xaml" has type "ASCII text with very long lines (584) with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\repair.png.xaml]- [targetUID: 00000000-00007824] "modify.png.xaml" has type "ASCII text with very long lines (383) with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\modify.png.xaml]- [targetUID: 00000000-00007824] "metroinstallbutton" has type "PNG image data 1020 x 54 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\metroinstallbutton]- [targetUID: 00000000-00007824] "remove.png.xaml" has type "ASCII text with very long lines (379) with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\remove.png.xaml]- [targetUID: 00000000-00007824] "metrorunapplicationbutton.xaml" has type "ASCII text with very long lines (373) with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\metrorunapplicationbutton.xaml]- [targetUID: 00000000-00007824] "metrobuttonimage" has type "PNG image data 624 x 37 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\metrobuttonimage]- [targetUID: 00000000-00007824] "backbutton" has type "PNG image data 624 x 37 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\backbutton]- [targetUID: 00000000-00007824] "nextcancelbuttons" has type "PNG image data 624 x 37 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\nextcancelbuttons]- [targetUID: 00000000-00007824] "viewreadmebutton.xaml" has type "ASCII text with very long lines (387) with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\viewreadmebutton.xaml]- [targetUID: 00000000-00007824] "sys_close_inactive.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\sys_close_inactive.png]- [targetUID: 00000000-00007824] "sys_close_hot.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\sys_close_hot.png]- [targetUID: 00000000-00007824] "sys_close_down.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\sys_close_down.png]- [targetUID: 00000000-00007824] "checkbox_for_ctrls" has type "PNG image data 192 x 16 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\checkbox_for_ctrls]- [targetUID: 00000000-00007824] "sys_close_normal.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\sys_close_normal.png]- [targetUID: 00000000-00007824] "sys_min_hot.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\sys_min_hot.png]- [targetUID: 00000000-00007824] "sys_min_down.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\sys_min_down.png]- [targetUID: 00000000-00007824] "sys_min_normal.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\sys_min_normal.png]- [targetUID: 00000000-00007824] "sys_min_inactive.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\sys_min_inactive.png]- [targetUID: 00000000-00007824] "print.png" has type "PNG image data 222 x 37 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\print.png]- [targetUID: 00000000-00007824] "checkbox" has type "PNG image data 192 x 16 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\checkbox]- [targetUID: 00000000-00007824] "browsebutton" has type "PNG image data 168 x 26 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\browsebutton]- [targetUID: 00000000-00007824] "checkbox_for_list_ctrls" has type "PNG image data 32 x 16 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\AI_EXTUI_BIN_7824\checkbox_for_list_ctrls]- [targetUID: 00000000-00007824] "frame_caption.bmp" has type "PC bitmap Windows 3.x format 1 x 38 x 24 image size 154 resolution 3779 x 3779 px/m cbSize 208 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_caption.bmp]- [targetUID: 00000000-00007824] "frame_caption_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 38 x 24 image size 154 resolution 3779 x 3779 px/m cbSize 208 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_caption_inactive.bmp]- [targetUID: 00000000-00007824] "frame_top_right_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_top_right_inactive.bmp]- [targetUID: 00000000-00007824] "frame_top_right.bmp" has type "PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_top_right.bmp]- [targetUID: 00000000-00007824] "frame_top_left_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_top_left_inactive.bmp]- [targetUID: 00000000-00007824] "frame_top_left.bmp" has type "PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_top_left.bmp]- [targetUID: 00000000-00007824] "backgroundsurface" has type "PC bitmap Windows 3.x format 5 x 5 x 32 image size 100 resolution 3780 x 3780 px/m cbSize 154 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\backgroundsurface]- [targetUID: 00000000-00007824] "backgroundprepare" has type "PC bitmap Windows 3.x format 5 x 5 x 24 image size 82 resolution 2834 x 2834 px/m cbSize 136 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\backgroundprepare]- [targetUID: 00000000-00007824] "frame_bottom_left_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_bottom_left_inactive.bmp]- [targetUID: 00000000-00007824] "frame_bottom_mid_inactive.bmp" has type "PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_bottom_mid_inactive.bmp]- [targetUID: 00000000-00007824] "frame_bottom_mid.bmp" has type "PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_bottom_mid.bmp]- [targetUID: 00000000-00007824] "frame_right.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_right.bmp]- [targetUID: 00000000-00007824] "frame_bottom_left.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_bottom_left.bmp]- [targetUID: 00000000-00007824] "MSIF87D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "MSI8536.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\MSI8536.tmp]- [targetUID: 00000000-00007824] "MSIF8ED.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "MSIF99C.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "MSI86A0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\MSI86A0.tmp]- [targetUID: 00000000-00007824] "MSIF89D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "MSI8641.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\MSI8641.tmp]- [targetUID: 00000000-00007824] "MSIF90D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "MSIF92D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "MSI8680.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\MSI8680.tmp]- [targetUID: 00000000-00007824] "MSIF95D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "MSIF82E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007824] "backbutton.xaml" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\backbutton.xaml]- [targetUID: 00000000-00007824] "browsebutton.xaml" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\browsebutton.xaml]- [targetUID: 00000000-00007824] "metrobuttonimage.xaml" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\AI_EXTUI_BIN_7824\metrobuttonimage.xaml]- [targetUID: 00000000-00007824] "frame_right_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_right_inactive.bmp]- [targetUID: 00000000-00007824] "frame_top_mid.bmp" has type "PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_top_mid.bmp]- [targetUID: 00000000-00007824] "frame_left_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_left_inactive.bmp]- [targetUID: 00000000-00007824] "frame_left.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_left.bmp]- [targetUID: 00000000-00007824] "frame_top_mid_inactive.bmp" has type "PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_top_mid_inactive.bmp]- [targetUID: 00000000-00007824] "frame_bottom_right.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_bottom_right.bmp]- [targetUID: 00000000-00007824] "frame_bottom_right_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54"- Location: [%TEMP%\AI_EXTUI_BIN_7824\frame_bottom_right_inactive.bmp]- [targetUID: 00000000-00007824]52:T52e,"MSIFA0B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" "MSIF87D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" "MSI8536.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%TEMP%\MSI8536.tmp] "MSIF8ED.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" "MSIF99C.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" "MSI86A0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%TEMP%\MSI86A0.tmp] "MSIF89D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" "MSI8641.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%TEMP%\MSI8641.tmp] "MSIF90D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" "MSIF92D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" "MSI8680.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%TEMP%\MSI8680.tmp] "MSIF95D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" "MSIF82E.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"53:T82e,"AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\DIRECTX\USERGPUPREFERENCES"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\0009"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\GRAPHICSDRIVERS"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\DIRECT3D"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\DIRECT3D"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\DIRECT3D\DRIVERS"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\DIRECT3D\DX6TEXTUREENUMINCLUSIONLIST"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\GRAPHICSDRIVERS\SCHEDULER"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\AVALON.GRAPHICS"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\AVALON.GRAPHICS"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\VIDEO\{C3FD0417-2B3B-11EE-88A6-806E6F6E6963}\0000"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\AVALON.GRAPHICS\DISPLAY1"; Key: ""; Value: "")54:T5b8,"AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78\PROPERTIES\{83DA6326-97A6-4088-9453-A1923F573B29}\0009"; Key: ""; Value: "") "AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "2F50C5D0-E25E-4F89-AB4A-31C63B518D7A"; Value: "") "AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\DIRECT3D\DRIVERS"; Key: "SIZE"; Value: "") "AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\DIRECT3D\DRIVERS"; Key: "NAME"; Value: "") "AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\DIRECT3D\DX6TEXTUREENUMINCLUSIONLIST"; Key: "SIZE"; Value: "") "AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\DIRECT3D\DX6TEXTUREENUMINCLUSIONLIST"; Key: "NAME"; Value: "") "AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\HARDWARE\DEVICEMAP\VIDEO"; Key: "\DEVICE\VIDEO0"; Value: "") "AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CLASS\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002"; Key: "PRUNINGMODE"; Value: "") "AutoTCryptoDesktop.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78"; Key: "HARDWAREID"; Value: "")55:T1016,Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml/presentation" Pattern match: "oft.com/expression/blend/2008" Pattern match: "http://schemas.microsoft.com/winfx/2" Pattern match: "http://schemas.microsoft.com/winfx/2006/xaml" Heuristic match: "lue=false /> mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com0ng$8zq,hb" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00007824.00000001.217774.00A60000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00007824.00000001.217774.094B0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json07/17" - Source: "00000000-00007824.00000001.217774.0A160000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,007/17" - Source: "00000000-00007824.00000001.217774.0A160000.00000002.mdmp") Found URL "https://autotcrypto.com/terms/aiwinuibtnmodifybackgroundnormalaiwinuibtnprintborderdisabledaiwinuibtnprintforegroundpressedaiwinuibtnborderopacitydisabledaiwinuibtnrepairbackgroundnormalaiwinuibtninstallborderpressed:\windows\system32\windows.ui.dllindows.ui.core.corewindow:\windows\system32\inputhost.dllai_bootstrapperoriginallang:\windows\system32\inputhost.dll:\windows\system32\windows.ui.dllframe_top_left_inactive.bmpai_cf_framecaptioninactivemetrorunapplicationbutton:\windows\system32\windows.ui.dllmetrorunapplicationbutton:\windows\system32\inputhost.dll:\windows\system32\inputhost.dllframe_top_mid_inactive.bmpframe_top_right_inactive.bmpframe_caption_inactive.bmpvailable" - Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp") Found URL "http://www.microsoft.com0ng$8zq,hb" - Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00007824.00000001.217774.0A970000.00000004.mdmp") Found URL "http://omboboxcal\tem" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "https://dlc.autotcrypto.com/clients/win32/[arch]/autotcrypto-win32-[arch]-latest.zipprimary" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "https://panel.autotcrypto.comdefault;disable;enable;hide;showaiwinuibtnmodifyforegroundnormalthe" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "https://autotcrypto.comai_bitmap_display_modeailicenseagreementlinkaiwinuibtnbordernormalframe_bottom_left.bmp" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/markup-compatibility/2006s" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmsuuuhhsm].sharepointlogdeletingsln:" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com0ng$8zq,hb" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00007824.00000002.219693.00A60000.00000004.mdmp") Found URL "http:// Microsoft Corporation","version_info":[{"id":"CompanyName","value":"Autotcrypto.com"},{"id":"FileDescription","value":"AutoTCrypto Desktop Installer"},{"id":"FileVersion","value":"101.1.3"},{"id":"InternalName","value":"AutoTCrypto Desktop"},{"id":"LegalCopyright","value":"Copyright (C) 2024 Autotcrypto.com"},{"id":"OriginalFileName","value":"AutoTCrypto Desktop.aiui"},{"id":"ProductName","value":"AutoTCrypto Desktop"},{"id":"ProductVersion","value":"101.1.3"},{"id":"Translation","value":"0x0429 0x04b0"}],"file_sections":[{"name":".text","entropy":6.460821366326179,"virtual_address":"0x1000","virtual_size":"0x29729a","raw_size":"0x297400","md5":"af7d2e8220eb16ff7f03a78de226f3c6"},{"name":".rdata","entropy":5.068944901847019,"virtual_address":"0x299000","virtual_size":"0xb3772","raw_size":"0xb3800","md5":"4f9d26185e37b65035edbc1141b2007e"},{"name":".data","entropy":4.472160620433143,"virtual_address":"0x34d000","virtual_size":"0xcb80","raw_size":"0x3400","md5":"e98ea88d23706ee22313e0c4a05673ed"},{"name":".didat","entropy":4.513561592019692,"virtual_address":"0x35a000","virtual_size":"0x704","raw_size":"0x800","md5":"024099aaf5ddf68616b817cf9ff2cd48"},{"name":".rsrc","entropy":5.1431286070321365,"virtual_address":"0x35b000","virtual_size":"0x30304","raw_size":"0x30400","md5":"a9a8f146f2abe241063bb263d1ea2809"},{"name":".reloc","entropy":6.565435959161859,"virtual_address":"0x38c000","virtual_size":"0x2d824","raw_size":"0x2da00","md5":"a06ea24eb8d925ce27348347ec27644f"}],"file_imports":[{"module":"imagehlp.dll","functions":["StackWalk","SymCleanup","SymFunctionTableAccess","SymGetLineFromAddr","SymGetModuleBase","SymInitialize","SymSetOptions","SymSetSearchPath"]},{"module":"KERNEL32.dll","functions":["AcquireSRWLockExclusive","CloseHandle","CompareFileTime","CompareStringEx","CompareStringW","ConnectNamedPipe","CopyFileExW","CopyFileW","CreateDirectoryW","CreateEventExW","CreateEventW","CreateFileW","CreateNamedPipeW","CreateProcessW","CreateSemaphoreW","CreateThread","CreateToolhelp32Snapshot","DecodePointer","DeleteCriticalSection","DeleteFileW","EncodePointer","EnterCriticalSection","EnumResourceLanguagesW","EnumSystemLocalesW","ExitProcess","ExitThread","FileTimeToSystemTime","FindClose","FindFirstFileExW","FindFirstFileW","FindNextFileW","FindResourceExW","FindResourceW","FlushFileBuffers","FlushInstructionCache","FormatMessageW","FreeEnvironmentStringsW","FreeLibrary","FreeLibraryAndExitThread","GetACP","GetCommandLineA","GetCommandLineW","GetConsoleMode","GetConsoleOutputCP","GetConsoleScreenBufferInfo","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetDiskFreeSpaceExW","GetDriveTypeW","GetEnvironmentStringsW","GetEnvironmentVariableW","GetExitCodeProcess","GetExitCodeThread","GetFileAttributesW","GetFileSize","GetFileSizeEx","GetFileTime","GetFileType","GetFinalPathNameByHandleW","GetFullPathNameW","GetLastError","GetLocaleInfoW","GetLocalTime","GetLogicalDriveStringsW","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleA","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetPrivateProfileSectionNamesW","GetPrivateProfileStringW","GetProcAddress","GetProcessAffinityMask","GetProcessHeap","GetShortPathNameW","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemDefaultLangID","GetSystemDirectoryW","GetSystemInfo","GetSystemTime","GetSystemTimeAsFileTime","GetTempFileNameW","GetTempPathW","GetTickCount","GetTimeFormatW","GetTimeZoneInformation","GetUserDefaultLangID","GetUserDefaultLCID","GetVersionExW","GetWindowsDirectoryW","GlobalAlloc","GlobalFree","GlobalLock","GlobalMemoryStatus","GlobalUnlock","HeapAlloc","HeapDestroy","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSection","InitializeCriticalSectionAndSpinCount","InitializeCriticalSectionEx","InitializeSListHead","InterlockedPopEntrySList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsValidLocale","IsWow64Process","LCMapStringEx","LCMapStringW","LeaveCriticalSection","LoadLibraryA","LoadLibraryExA","LoadLibraryExW","LoadLibraryW","LoadResource","LocalAlloc","LocalFree","LockResource","lstrcmpiW","lstrcmpW","lstrcpynW","lstrlenW","MoveFileW","MulDiv","MultiByteToWideChar","OpenEventW","OutputDebugStringW","PeekNamedPipe","Process32FirstW","Process32NextW","QueryPerformanceCounter","QueryPerformanceFrequency","RaiseException","ReadConsoleW","ReadFile","ReleaseSemaphore","ReleaseSRWLockExclusive","RemoveDirectoryW","ResetEvent","RtlUnwind","SetConsoleTextAttribute","SetCurrentDirectoryW","SetEndOfFile","SetEnvironmentVariableW","SetEvent","SetFileAttributesW","SetFilePointer","SetFilePointerEx","SetFileTime","SetLastError","SetStdHandle","SetUnhandledExceptionFilter","SizeofResource","Sleep","SleepConditionVariableSRW","SystemTimeToFileTime","TerminateProcess","TerminateThread","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","VerifyVersionInfoW","VerSetConditionMask","VirtualAlloc","VirtualFree","VirtualProtect","VirtualQuery","WaitForMultipleObjects","WaitForSingleObject","WaitForSingleObjectEx","WakeAllConditionVariable","WideCharToMultiByte","Wow64DisableWow64FsRedirection","Wow64RevertWow64FsRedirection","WriteConsoleW","WriteFile","WritePrivateProfileStringW"]}],"file_exports":[]}},{"name":"AutoTCrypto Desktop.msi","file_path":"%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\AutoTCrypto Desktop.msi","file_size":4018688,"md5":"67b97c21b7c46a639d689ff849131bce","sha1":"61aa5cbb8a3a751b503ddc47133657f2af32af5c","sha256":"78beeaef8650a7c5b925c0a0082a182b44e26b956effaae6e858d7d7778b1dc0","sha512":"d1e12763dc06b7b378c6b9913d385b43a96faf6a355b5d0dc2707398dba33dd50a84c4ab8b0d7c0212b993821754c1c46b3c7bcd9423ef3e7d00c90aafa359e5","type_tags":["msi","data"],"description":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: AutoTCrypto Desktop, Author: Autotcrypto.com, Keywords: Installer, MSI, Database, Comments: autotcrypto.com, Create Time/Date: Fri Aug 30 11:00:20 2024, Name of Creating Application: AutoTCrypto Desktop, Security: 0, Template: ;1065, Last Saved By: ;1033, Revision Number: {E75096F1-6C4B-426F-8E87-7D68B81655E9}101.1.3;{E75096F1-6C4B-426F-8E87-7D68B81655E9}101.1.3;{0426815D-EE79-406C-8760-EDBE60E4A13F}, Number of Pages: 450, Number of Characters: 63","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=d0fda15f967a4211e229949b2b808aae6d57fa784da331cae284baf172e4d15b0d8f2fe14d6935fc1b8ddd0306d869dafdd746f2fd65824adbfe9e8f72ed76a60e94cce8b458cf753ea50c9bb0c4a60553d6","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=d0fda15f967a4211e229949b2b808aae6d57fa784da331cae284baf172e4d15b0d8f2fe14d6935fc1b8ddd0306d869dafdd746f2fd65824adbfe9e8f72ed76a60e94cce8b458cf753ea50c9bb0c4a60553d6","has_overview":true,"extended_details":null},{"name":"ExternalUICleaner.dll","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\ExternalUICleaner.dll","file_size":298336,"md5":"f6b3cb2edaff1076526e67bbf0e498cf","sha1":"612a149bf99e824d21024ef1afc3ca503228dd4f","sha256":"efa05b4ae13126264930156a5dca492a9bba8815da8947dca72ff2b45dcb9992","sha512":"21aba600a5f77c17d6a02e16faaea9066284b9643f31d9ee0af3a9ac42510dee1755b6c413f6e77e14ef9c7ccd244c64688366d9b4a0debbc10831cd62539030","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=f4dcc92a79877b1097d0c0032204ce551ee94b66f0ce29cb4b378a8ec410ec160f110f37d57ddd86f4d53b78612cea8a22e48d7412eeabb83c00b945edd4cb2f36189961cbcd105811228445e17de15e","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=f4dcc92a79877b1097d0c0032204ce551ee94b66f0ce29cb4b378a8ec410ec160f110f37d57ddd86f4d53b78612cea8a22e48d7412eeabb83c00b945edd4cb2f36189961cbcd105811228445e17de15e","has_overview":true,"extended_details":{"filename":"ExternalUICleaner.dll","size":298336,"description":null,"architecture":"32 Bit","ssdeep":"6144:mHpwj0n6BIph0lhSMXlBXBW/eqV5t6hyP:Cpwj0jph0lhSMXlenV5khE","imphash":"39e68ab441839f097d813822a4002a33","authentihash":"a182604577ef33cf358e763b2e0db77b0f0d93dca4d47130be74e47e73f50de8","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"CompanyName","value":"Caphyon LTD"},{"id":"FileDescription","value":"Custom action that deletes files used by external UI during maintenance"},{"id":"FileVersion","value":"21.4.0.0"},{"id":"InternalName","value":"ExternalUICleaner.dll"},{"id":"LegalCopyright","value":"(c) Caphyon LTD. All rights reserved."},{"id":"OriginalFilename","value":"ExternalUICleaner.dll"},{"id":"ProductName","value":"Advanced Installer"},{"id":"ProductVersion","value":"21.4.0.0"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":6.6039295936479725,"virtual_address":"0x1000","virtual_size":"0x1ad9a","raw_size":"0x1ae00","md5":"49cc4c39cd140d4e84cc2fd6bc1fda14"},{"name":".rdata","entropy":6.617569256065548,"virtual_address":"0x1c000","virtual_size":"0x27164","raw_size":"0x27200","md5":"746e05a4c947d6956f7a1f0e96d1ca4c"},{"name":".data","entropy":2.3356588515668437,"virtual_address":"0x44000","virtual_size":"0x1994","raw_size":"0xc00","md5":"213fedd0b87325de870c67d35efbe044"},{"name":".rsrc","entropy":3.9581319784539444,"virtual_address":"0x46000","virtual_size":"0x5b0","raw_size":"0x600","md5":"ac15208700f9c9b3fdaf2900f0f8acf2"},{"name":".reloc","entropy":6.604848529295104,"virtual_address":"0x47000","virtual_size":"0x19fc","raw_size":"0x1a00","md5":"d02888657a1dd986c49588240478d88a"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["AllocateAndInitializeSid","EqualSid","FreeSid","GetSecurityDescriptorDacl","GetTokenInformation","InitializeSecurityDescriptor","LookupAccountSidW","OpenProcessToken","SetEntriesInAclW","SetSecurityDescriptorDacl"]},{"module":"KERNEL32.dll","functions":["AcquireSRWLockExclusive","CloseHandle","CreateDirectoryW","CreateFileW","DecodePointer","DeleteCriticalSection","DeleteFileW","EncodePointer","EnterCriticalSection","ExitProcess","FindClose","FindFirstFileExW","FindFirstFileW","FindNextFileW","FindResourceExW","FindResourceW","FlushFileBuffers","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetCommandLineA","GetCommandLineW","GetConsoleMode","GetConsoleOutputCP","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetEnvironmentStringsW","GetFileType","GetLastError","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessHeap","GetShortPathNameW","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","GetTempFileNameW","GetTempPathW","GetWindowsDirectoryW","HeapAlloc","HeapDestroy","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","InitializeCriticalSectionEx","InitializeSListHead","InterlockedFlushSList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","LoadLibraryW","LoadResource","LocalAlloc","LocalFree","LockResource","MoveFileW","MultiByteToWideChar","OutputDebugStringW","QueryPerformanceCounter","RaiseException","ReleaseSRWLockExclusive","RtlUnwind","SetFilePointerEx","SetLastError","SetStdHandle","SetUnhandledExceptionFilter","SizeofResource","SleepConditionVariableSRW","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WakeAllConditionVariable","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"msi.dll","functions":[]},{"module":"SHELL32.dll","functions":["ShellExecuteExW","ShellExecuteW"]},{"module":"SHLWAPI.dll","functions":["PathFileExistsW","PathIsUNCW"]}],"file_exports":[{"name":"DoRemoveExternalUIStub","ordinal":1,"address":"0x10007520"},{"name":"RemoveExternalUIStub","ordinal":2,"address":"0x10007300"}]}},{"name":"New","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\New","file_size":15086,"md5":"1e80de80cefee55d7cfda0df2edcf3b2","sha1":"6e567d732354bbb21f9a57bbb72730c497f35380","sha256":"4e64f4e40d8cbff082b37186c831af4b49e3131c62c00a0cf53e0a6e7e24ac2b","sha512":"5efea023b18ffd5b87a19837ba2c72c179b55b7c3071b773a032c63d7268dbe25e2902ae8b111ad83a4f005346b378c7a75033adaee90805bcb4fec2822e54c0","type_tags":["image","ico"],"description":"MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=769a4906d354b08120d7c44946132501dc34d333affb48cc2ecc479b0c8eb9df66abc6c880be5bff7447c6aeef07666e5d4b8f0e2a536879a7f00e1e0d","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=769a4906d354b08120d7c44946132501dc34d333affb48cc2ecc479b0c8eb9df66abc6c880be5bff7447c6aeef07666e5d4b8f0e2a536879a7f00e1e0d","has_overview":true,"extended_details":null},{"name":"PrepareDlgProgress.gif","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\PrepareDlgProgress.gif","file_size":17651,"md5":"2591fe773f89f96b466ef81cacac9fcd","sha1":"486434497166140e249a3713d584314be8d31ebf","sha256":"120b14fb158c6c864c2932836fe3490221abd62247bbf476a8ad5561480c1daa","sha512":"65eb7907ab34d78772e447e20d176626b74dd40a256ba08cd5eff3881a3db7474f30e9cb848c855c41f97829c7422b54da82e21dcb16236a18cd4583bf405346","type_tags":["image","gif"],"description":"GIF image data, version 89a, 83 x 28","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=65e1d2c1fb1aaf706c21ce9075ef7516e43c3f112144fbdf9ae48c26d5f506523dd5a19850a0b6a80cc2dfb47a676246a2aa426ce81ee84edceb381e1394faf32d071ac11dae1ac66834b9204b88d24a59","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=65e1d2c1fb1aaf706c21ce9075ef7516e43c3f112144fbdf9ae48c26d5f506523dd5a19850a0b6a80cc2dfb47a676246a2aa426ce81ee84edceb381e1394faf32d071ac11dae1ac66834b9204b88d24a59","has_overview":false,"extended_details":null},{"name":"ProgressImage.png","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\ProgressImage.png","file_size":1875,"md5":"8fcfcbd73c1d57f68ce7bfc85d3cecbd","sha1":"2e3ac95608c06929ce0ec2b837d1dc6fe53842f8","sha256":"cd3459d640a9a0b65edd27b4a79a5e12d26c340e088d095dd71f0a425b692f13","sha512":"d355f3a0498690c7a37ff11f5c22a5ed77a2e90db240f5a501f124628631649fc3cc449f51fb99c93d47db7ebed62030110be55cd352f4c525b3906d8d98b9c2","type_tags":["image","png"],"description":"PNG image data, 121 x 14, 8-bit/color RGB, non-interlaced","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=41e85cfe5055fd0932d04ee395acef93274ebf8fcd87a801fd67ce342b000f501aec1a5346dac81b333ef413e11c730cd9c2df6826a23c53178f4b3ab79c898960efec45a828083de0cf96b0","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=41e85cfe5055fd0932d04ee395acef93274ebf8fcd87a801fd67ce342b000f501aec1a5346dac81b333ef413e11c730cd9c2df6826a23c53178f4b3ab79c898960efec45a828083de0cf96b0","has_overview":false,"extended_details":null},{"name":"Up","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\Up","file_size":15086,"md5":"fd64f54db4cbf736a6fc0d7049f5991e","sha1":"24d42fb471aaa7bcd54d7ccb36480f5add9b31d4","sha256":"c269353d19d50e2688db102fef8226ca492db17133043d7eb5420ee8542d571c","sha512":"ec622afab084016f144864967a41d647e813282cb058f0f11e203865c0c175ba182e325a6d5164580ff00757c8475b61de89ccc8e892e1b030e51b03ad4eafb4","type_tags":["image","ico"],"description":"MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=ce0fdaa0815473a21d30bbf6e2220bb040117a304c85b5e0347974756792b160efabfa644286a6f7ed1c8c5d9cc4430e2b6e26a8f05fd946702bd3e5","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=ce0fdaa0815473a21d30bbf6e2220bb040117a304c85b5e0347974756792b160efabfa644286a6f7ed1c8c5d9cc4430e2b6e26a8f05fd946702bd3e5","has_overview":true,"extended_details":null},{"name":"backbutton","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\backbutton","file_size":1259,"md5":"9bdc1b9b1e0fb9011463ac582e38e293","sha1":"60cd6fe51bf707b9ca79c126b3468f9927bd33c7","sha256":"5278997c2bebd076a38b9aed6dcf7d385b03b23d2e430c3dd20c2fcfe7bb5ce5","sha512":"5576dfec7ab35adc52eda109858a948ca71983effeecc97c8ddaf946f8dbf678d19687e0a38b584521d0fb6ec8900dcd8d8b52be1b1af53a444b43e03700a006","type_tags":["image","png"],"description":"PNG image data, 624 x 37, 8-bit/color RGBA, non-interlaced","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=d9652c14577e97ea4bafd9be8e1453edad3868bb1c2f79debc280d08aa4a278136d8e5b57936a0553c4f31ce12823c1b451d15a9b1bda4aec5e4f63e3451d311503832f39c","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=d9652c14577e97ea4bafd9be8e1453edad3868bb1c2f79debc280d08aa4a278136d8e5b57936a0553c4f31ce12823c1b451d15a9b1bda4aec5e4f63e3451d311503832f39c","has_overview":false,"extended_details":null},{"name":"backbutton.xaml","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\backbutton.xaml","file_size":1929,"md5":"3dec9f3886a7d180b1da7a72541dbf81","sha1":"07f3ba034be78970a86d055daed59bf7d87f8d21","sha256":"fb1c5df8785650b20612b61a66ecbda5e1ed323d6c8ac45b2ebccbe9193779f8","sha512":"0250b81a2795fcac69e3f2c95bdff406f01ff207e81bead96b2739f28e26dd2d97d82cccbfbd92b7141b1eabd2310db048618fef1cc5261fdff212d19bb910bf","type_tags":["html"],"description":"HTML document, ASCII text, with CRLF line terminators","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=0b5eddf4b1d6671c868d86e1584ce52e81e8fae742b55ccbda11ff2dd2f3ff0deb53c9198486dc060f6b1eca69593ee9706bc9b77245ef39d0fe48257b0427baf6c689c820c5a5408de0","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=0b5eddf4b1d6671c868d86e1584ce52e81e8fae742b55ccbda11ff2dd2f3ff0deb53c9198486dc060f6b1eca69593ee9706bc9b77245ef39d0fe48257b0427baf6c689c820c5a5408de0","has_overview":true,"extended_details":null},{"name":"background","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\background","file_size":266950,"md5":"50043cae8d1816a580e87ef2a3617630","sha1":"2ce180519b940b6413c0fef8ce941cb0db54b564","sha256":"7bb4daa00294c7a23226463df8c6e2bf744e9f44b41b1c7f24af033bfdb84262","sha512":"c1c698c5777518544ad7e36bd34f04d89d53ce4a5512af48d7682d7881f43117d7f5ccd3c3f138cdba847025c6b1189cf0db854aa5e55942c4de63bece03ad20","type_tags":["image","bmp"],"description":"PC bitmap, Windows 3.x format, 462 x 573 x 8, cbSize 266950, bits offset 1078","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=d84c3b45b140474ed81ea89ba8c0bb9260b0517c2c019d37c081d999c82a3d6e5dfa8ac3665afab59f049d41fa050cbb005b2973272870ba7c6abee5be0b4bbb62b538513c","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=d84c3b45b140474ed81ea89ba8c0bb9260b0517c2c019d37c081d999c82a3d6e5dfa8ac3665afab59f049d41fa050cbb005b2973272870ba7c6abee5be0b4bbb62b538513c","has_overview":false,"extended_details":null},{"name":"backgroundprepare","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\backgroundprepare","file_size":136,"md5":"04394fbdbf1dfd37364a5a038546f7c0","sha1":"59618f5c12c555d7040689a685513f126b056d87","sha256":"2b3f0deb6f950a0d9067fdbcdb73f7024f951ed47e8d616b1fdabc8396afe59c","sha512":"afd87d82d037ca0b3e58ed322e01c3e165a139e1798cbd37c1186e20d55b8288cfe655c589a573d3eb8aafe83b2b56c7a056ca5ccd38dfc054cd6251530388d0","type_tags":["image","bmp"],"description":"PC bitmap, Windows 3.x format, 5 x 5 x 24, image size 82, resolution 2834 x 2834 px/m, cbSize 136, bits offset 54","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=e872064f83496fd97eacf79bc5e89e2c36485d0edd7501f6bd1f6dc967db5d86150e2e011feff2868f89ebd38c3bc1d2cef2c471b2d968dd3d8d3aad063533beea336deb09f9dac7d56e26de","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=e872064f83496fd97eacf79bc5e89e2c36485d0edd7501f6bd1f6dc967db5d86150e2e011feff2868f89ebd38c3bc1d2cef2c471b2d968dd3d8d3aad063533beea336deb09f9dac7d56e26de","has_overview":false,"extended_details":null},{"name":"backgroundsurface","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\backgroundsurface","file_size":154,"md5":"8fd875cdc559ad66e0a94c64fdb762c3","sha1":"79111743f1ef8da31688f1644f9568a42fbd3ed5","sha256":"fe7c2d4c244139591b0b716a410a1d8af38084cdc560a2beb265bdb8578e4eb3","sha512":"0985a7456bd94e21d62428368c8e52ef7021fe78966dd967b96ecbbf05542abba4f8c85ef3d56bc0f5f9500e0d0828d4b54feaeef9768f85ff754ca8a1b5af3b","type_tags":["image","bmp"],"description":"PC bitmap, Windows 3.x format, 5 x 5 x 32, image size 100, resolution 3780 x 3780 px/m, cbSize 154, bits offset 54","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=42af2e75172f5850041eea457c94dee07ec845c4070a6cfe7b3def60e84d159816a7ee4c7701a9d25cb02133cd7ba5917277084813d8d61e8f8f0937f41942c0754798d755df1d54bc1e540c","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=42af2e75172f5850041eea457c94dee07ec845c4070a6cfe7b3def60e84d159816a7ee4c7701a9d25cb02133cd7ba5917277084813d8d61e8f8f0937f41942c0754798d755df1d54bc1e540c","has_overview":false,"extended_details":null},{"name":"browsebutton","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\browsebutton","file_size":595,"md5":"c88b4735316c02005cc4a3091c4abe27","sha1":"10c99fe9fe257b0ffedbfb398567c4f854f64ed3","sha256":"fa7f44f81f716c63b203d2a81af68140a7b2f466129a052c5f153d44c5017ed3","sha512":"4a51dbd872a8e4855efc8c3bed260e1aa3cd1d56250447ea71a3cd865700ead9b16bc27a0233f0ad7eabc86f44d1488fc2e32a0b93b1a7a50b90577a1f7c8a93","type_tags":["image","png"],"description":"PNG image data, 168 x 26, 8-bit/color RGBA, non-interlaced","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=3df2a04b6c60eddd1c3089ff70d0534ea13911eb4e11754aa258627a86180b9613af91ced93d21e3801b499ee3b9f0f5f1d11a7e129285e1df3c7a2093ff680d8f9d73898823ca","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=3df2a04b6c60eddd1c3089ff70d0534ea13911eb4e11754aa258627a86180b9613af91ced93d21e3801b499ee3b9f0f5f1d11a7e129285e1df3c7a2093ff680d8f9d73898823ca","has_overview":false,"extended_details":null},{"name":"browsebutton.xaml","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\browsebutton.xaml","file_size":1929,"md5":"3dec9f3886a7d180b1da7a72541dbf81","sha1":"07f3ba034be78970a86d055daed59bf7d87f8d21","sha256":"fb1c5df8785650b20612b61a66ecbda5e1ed323d6c8ac45b2ebccbe9193779f8","sha512":"0250b81a2795fcac69e3f2c95bdff406f01ff207e81bead96b2739f28e26dd2d97d82cccbfbd92b7141b1eabd2310db048618fef1cc5261fdff212d19bb910bf","type_tags":["html"],"description":"HTML document, ASCII text, with CRLF line terminators","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=5b9567d5f1a399df3c30828509c3291dd97f30610300df5f0e715a35483cbc695a3c830f0908df1e0e8116d541e5c961e35b48b6e944f3360cd6b565e34de6a414bfc39b62fe505659c8ff","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=5b9567d5f1a399df3c30828509c3291dd97f30610300df5f0e715a35483cbc695a3c830f0908df1e0e8116d541e5c961e35b48b6e944f3360cd6b565e34de6a414bfc39b62fe505659c8ff","has_overview":true,"extended_details":null},{"name":"checkbox","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\checkbox","file_size":602,"md5":"db6fbf36971ca30f8cc4186d484df3f7","sha1":"79a19416335fd5a9e47f45287def811afbdc1220","sha256":"137975654d3065f7eb9de665820361aeb41e850e90fd27dfe13d7cb0b1ece458","sha512":"36281e36c03f5896a27b8ddd90cc31d47bdb2b37951e2b3611920635e87ca53cae3159be2e0455d84ae078fa0d85cf2e56b0a9d9585079b47199c61cd9ad5544","type_tags":["image","png"],"description":"PNG image data, 192 x 16, 8-bit/color RGBA, non-interlaced","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=555278a5ae71588419d0b2d5163798b236f042b3f66f93020113cc5df9e9549b76beba14cf448d8d8f3d738e7e7d3a08081e943f45a31e58938c78e16c1fdc2d3e86c8","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=555278a5ae71588419d0b2d5163798b236f042b3f66f93020113cc5df9e9549b76beba14cf448d8d8f3d738e7e7d3a08081e943f45a31e58938c78e16c1fdc2d3e86c8","has_overview":false,"extended_details":null},{"name":"checkbox_for_ctrls","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\checkbox_for_ctrls","file_size":1138,"md5":"2c93347a1d111b5a0f63234ff90feb4c","sha1":"a8a8c8c208c9b9c2305d27d38efb70952b9a50f1","sha256":"d321ad9f1b5bd62a7ed783fb2b31377aa967b7632d49019d1ad4f7f3c37e5efb","sha512":"2039036550b3fb996aa1a03210192f381fb700a80e486dc4bf6496dda39f666f66df0e85c65bc5c0762a84a8cbc57e77bb04204db7cbdb846bd119ba37b95a79","type_tags":["image","png"],"description":"PNG image data, 192 x 16, 8-bit/color RGBA, non-interlaced","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=a160c29d40df1cd50b217e9c5ff6f0721c148705cc86e2d354f20aa3e3e932416a6b5ad71855af14181062af9d056baad14f1d4dad2a03ec58a0b00d835f3012194ba716e2c62a7b74e5976a09","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=a160c29d40df1cd50b217e9c5ff6f0721c148705cc86e2d354f20aa3e3e932416a6b5ad71855af14181062af9d056baad14f1d4dad2a03ec58a0b00d835f3012194ba716e2c62a7b74e5976a09","has_overview":false,"extended_details":null},{"name":"checkbox_for_list_ctrls","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\checkbox_for_list_ctrls","file_size":336,"md5":"8ba7adc3ef92c971f0946f41fddd6be0","sha1":"ca3ff7e787a9bfdb631df75b46ed0d58281a5f6a","sha256":"dfca0c8ee1d43f15c751206ed86718b0247736ce5ce166f8935b91a9d37afbc7","sha512":"321448d699896e2afc850371159462b170f09bcedfbd8dd7c96f10736465f133bf2decc9cdc687dd43e98a8bcd9bff3703532e4f0dfc8edac0871c51ee48df3b","type_tags":["image","png"],"description":"PNG image data, 32 x 16, 8-bit/color RGBA, non-interlaced","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=7631d4f234bde5d36eb80abffedce18679d48b6a26613b5ec9a08d06f3eadff681567eb364810628ab0ff1e4963051fd8f1ca7fd4b41ee3766e226945fe049e268f638582a25f9d34795c9602e927417","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=7631d4f234bde5d36eb80abffedce18679d48b6a26613b5ec9a08d06f3eadff681567eb364810628ab0ff1e4963051fd8f1ca7fd4b41ee3766e226945fe049e268f638582a25f9d34795c9602e927417","has_overview":false,"extended_details":null},{"name":"cmdlinkarrow","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\cmdlinkarrow","file_size":2862,"md5":"983358ce03817f1ca404befbe1e4d96a","sha1":"75ce6ce80606bbb052dd35351ed95435892baf8d","sha256":"7f0121322785c107bfdfe343e49f06c604c719baff849d07b6e099675d173961","sha512":"bdee6e81a9c15ac23684c9f654d11cc0db683774367401aa2c240d57751534b1e5a179fe4042286402b6030467db82eedbf0586c427faa9b29bd5ef74b807f3e","type_tags":["image","ico"],"description":"MS Windows icon resource - 3 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=043da55404cd579e79c168e4475a4506788426dc91137f58d61476ae4a6c2daa42d8a998ed359c89d6ab615c520606bfbbd5703c65cc3625e60aad5ca8918a30e12eb598ad958a","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=043da55404cd579e79c168e4475a4506788426dc91137f58d61476ae4a6c2daa42d8a998ed359c89d6ab615c520606bfbbd5703c65cc3625e60aad5ca8918a30e12eb598ad958a","has_overview":true,"extended_details":null},{"name":"completi","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\completi","file_size":13430,"md5":"244df84c545247a478bef4a1bbc1399d","sha1":"c69ed79145bb40ba18a92996b0a242585afe315e","sha256":"520e5248975b3b8e6c5d574d57080f901c88fe59d4dff6a89fab524fb51fe606","sha512":"bb2739344b369e5fccb72b8762e30c38a2ac8ec949bdc8cb56619f526e3954ed5ae159d6be4bac2e0c10c4bc2f14820102a2d409ad17bb5a9bbd77e34441cf69","type_tags":["image","ico"],"description":"MS Windows icon resource - 2 icons, 48x48, 8 bits/pixel, 48x48, 32 bits/pixel","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=6a863aeb04a6c21aee4eb4bd4fba0378bf71724a4a76502087d4cb14e89ddab6f9b03d97ed52fcf8c998e70038b1a31767f44425071b589e4596e7f1335a3b0988214a","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=6a863aeb04a6c21aee4eb4bd4fba0378bf71724a4a76502087d4cb14e89ddab6f9b03d97ed52fcf8c998e70038b1a31767f44425071b589e4596e7f1335a3b0988214a","has_overview":true,"extended_details":null},{"name":"lzmaextractor.dll","file_path":"%TEMP%\\AI_EXTUI_BIN_7824\\lzmaextractor.dll","file_size":22880,"md5":"a1f2489d9b5088a74c18abc6f174a686","sha1":"21b288c3df4044969418108acf16000d70584b33","sha256":"913bbaede66f7c2f00b92916d5cad558067b589bca0b782409e96cb6bf48106e","sha512":"5d7c1f4cffc2ec28f95b4ec98a0a71f85285758fef0eb66f3a75e7d2bd25208d1cfc00f6b8611f16d86a374bcbcea00e7892c6595463eadb9eb03f0da86a78c0","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","runtime_process":"AutoTCryptoDesktop.exe (PID: 7824)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/687964e436f0bdb80103f15d/download/dropped-file?key=a3ccadf8d79e0efbb6a02d2f04d6bbfeb43789a27cab404c99d598778e3d4f594474e17fc191721651df316039432a36bc0feec97ea40afed588bee005993e60dc4beb76fbf7c69bf471d6e3","submit_link":"/bff/report/687964e436f0bdb80103f15d/submit/dropped-file?key=a3ccadf8d79e0efbb6a02d2f04d6bbfeb43789a27cab404c99d598778e3d4f594474e17fc191721651df316039432a36bc0feec97ea40afed588bee005993e60dc4beb76fbf7c69bf471d6e3","has_overview":true,"extended_details":{"filename":"lzmaextractor.dll","size":22880,"description":null,"architecture":"32 Bit","ssdeep":"384:bMwrU16rdrjZLTtFubhLTtFubvXa/rl9qX2Ip4A/9igRqjdAA1m5wMPhzmuf0Kf8:bM18n3cl3c/KrLy2Ip4MRqxf1mlZxf0N","imphash":"b0a79b4fe00fbd8008e28124872fa0a2","authentihash":"a34b7cd8ad13999cde84b0a2b230b63920fdbafc340a396a888bedb611d850ea","entrypoint_bytes":null,"packer":null,"version_info":[{"id":"CompanyName","value":"Caphyon LTD"},{"id":"FileDescription","value":"Custom action that extracts a LZMA archive"},{"id":"FileVersion","value":"21.4.0.0"},{"id":"InternalName","value":"lzmaextroctor.dll"},{"id":"LegalCopyright","value":"(c) Caphyon LTD. All rights reserved."},{"id":"OriginalFilename","value":"lzmaextractor.dll"},{"id":"ProductName","value":"Advanced Installer"},{"id":"ProductVersion","value":"21.4.0.0"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":4.931689448991694,"virtual_address":"0x1000","virtual_size":"0x62c","raw_size":"0x800","md5":"9863996617a91ed3450e013b4b9322dd"},{"name":".rdata","entropy":3.7060461828933553,"virtual_address":"0x2000","virtual_size":"0x688","raw_size":"0x800","md5":"7efea34ac64aa283b16ad8e854debe62"},{"name":".data","entropy":0,"virtual_address":"0x3000","virtual_size":"0x4","raw_size":"0x0","md5":"d41d8cd98f00b204e9800998ecf8427e"},{"name":".rsrc","entropy":3.8541432366404593,"virtual_address":"0x4000","virtual_size":"0x568","raw_size":"0x600","md5":"e878c9b872d32330373a3d8aa57a001e"},{"name":".reloc","entropy":1.565905545605518,"virtual_address":"0x5000","virtual_size":"0x60","raw_size":"0x200","md5":"bb4bfe52ba36228e64e725559ea17058"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["GetUserNameW"]},{"module":"COMDLG32.dll","functions":["GetOpenFileNameW"]},{"module":"KERNEL32.dll","functions":["GetComputerNameW","RemoveDirectoryW","WaitForSingleObject"]},{"module":"msi.dll","functions":[]},{"module":"SHELL32.dll","functions":["ShellExecuteExW","SHFileOperationW"]},{"module":"SHLWAPI.dll","functions":["PathFileExistsW"]}],"file_exports":[{"name":"DeleteExtractionPath","ordinal":1,"address":"0x10001470"},{"name":"DeleteLZMAFiles","ordinal":2,"address":"0x100013c0"},{"name":"ExpandExtractionPath","ordinal":3,"address":"0x100013d0"},{"name":"ExtractLZMAFiles","ordinal":4,"address":"0x100013b0"},{"name":"FindEXE","ordinal":5,"address":"0x10001140"}]}}],"file_metadata":{"file_compositions":["1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 33134)","1 Unknown Resource Files (build: 0)","388 .BAS Files compiled with C2.EXE 5.0 (Visual Basic 6) (build: 33134)"],"imported_objects":["1 .BAS Files compiled with C2.EXE 5.00 (Visual Studio 5) (build: 29395)","27 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 29395)","12 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 29395)","109 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 33030)","25 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 33030)","20 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 33030)","1 .RES Files linked with CVTRES.EXE 5.00 (Visual Studio 5) (build: 29395)","187 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 29395)"],"file_analysis":["File contains Visual Basic code","File appears to contain raw COFF/OMF content","File is the product of a large codebase (388 files)"],"total_file_compositions_imports":9},"processes":[{"uid":"00000000-00007824","parentuid":null,"name":"AutoTCryptoDesktop.exe","normalized_path":"C:\\AutoTCryptoDesktop.exe","command_line":null,"sha256":"55d2b5ae592975bb6fea4c20c43c09d4f37d04d75fac7531da449d33d296c037","av_label":null,"av_matched":null,"av_total":null,"pid":"7824","icon":"$37","process_flags":[]},{"uid":"00000000-00008788","parentuid":null,"name":"msiexec.exe","normalized_path":"%WINDIR%\\system32\\msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","av_label":null,"av_matched":null,"av_total":null,"pid":"8788","icon":"$38","process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00007940","parentuid":"00000000-00008788","name":"MsiExec.exe","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","command_line":"-Embedding ADA04CC79F552EEE78334EF5DC769465 C","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","av_label":null,"av_matched":null,"av_total":null,"pid":"7940","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to create/connect to a named pipe (API string)","Found named pipe like strings"],"parent":null},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":["Imports suspicious APIs"],"informative_identifiers_count":14,"informative_identifiers":["Contains ability to create a new process (API string)","Contains ability to create/open files (API string)","Contains ability to execute an application (API string)","Contains ability to execute Windows APIs","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to retrieve the fully qualified path of module (API string)","Contains ability to find and load resources of specific modules (API string)","Contains ability to load modules (API string)","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to retrieve/modify process thread (API string)","Calls an API typically used to retrieve function addresses","Calls an API typically used to find a resource in a module","Calls an API typically used to load a resource in memory","Imports GetCommandLine API"],"parent":null},{"tactic":"Execution","technique":"Software Deployment Tools","attck_id":"T1072","attck_id_wiki":"https://attack.mitre.org/techniques/T1072","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to software packages activity (Powershell command string)"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the command-line string for the current process (API string)"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"PowerShell","attck_id":"T1059.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Observed Powershell command strings"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to execute a WMI query"],"parent":null},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1569.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to open a service (API string)"],"parent":{"technique":"System Services","attck_id":"T1569","attck_id_wiki":"https://attack.mitre.org/techniques/T1569"}},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Calls an API typically used to load libraries","Loads modules at runtime","Fails to load modules at runtime","Loads rich edit control libraries","Loads the RPC (Remote Procedure Call) module DLL"],"parent":null},{"tactic":"Persistence","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Persistence","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies Software Policy Settings"],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to delete registry key/value (API string)","Contains ability to create/load registry keys (API string)","Contains ability to modify registry key/value (API string)","Accesses System Certificates Settings"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to modify system service (API string)","Contains ability to access device drivers","Contains ability to start a service (API string)"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Windows Startup folder"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to impersonate access tokens (API string)","Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate another user on the local machine (API string)","Imports system security related APIs"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to modify system service (API string)","Contains ability to access device drivers","Contains ability to start a service (API string)"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to inject code into another process (API string)","Found PE header in memory"],"parent":null},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify access token privileges (API string)","Calls an API typically used to enable or disable privileges in the specified access token"],"parent":null},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Windows Startup folder"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used to query local/system time as file time"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve file time (API string)","Contains ability to set file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file attributes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment using user register activity","Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies Software Policy Settings"],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to delete registry key/value (API string)","Contains ability to create/load registry keys (API string)","Contains ability to modify registry key/value (API string)","Accesses System Certificates Settings"],"parent":null},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to impersonate access tokens (API string)","Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate another user on the local machine (API string)","Imports system security related APIs"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["CRC value set in PE header does not match actual value"],"informative_identifiers_count":9,"informative_identifiers":["Contains CRYPTO related strings","Contains ability to perform AES/RC4 encryption (API string)","Contains ability to use Cryptographic classes","Loads the Bcrypt module DLL","Matched Compiler/Packer signature (DIE)","YARA signature match - AES encryption","PE file contains zero-sized sections","YARA signature match - RC4 Encryption","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file system redirection (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete files/directories (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to inject code into another process (API string)","Found PE header in memory"],"parent":null},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to pass information to a window procedure (API string)","Contains ability to show a graphical window (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify access token privileges (API string)","Calls an API typically used to enable or disable privileges in the specified access token"],"parent":null},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attck_id":"T1562.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to uninstall applications (Powershell command string)"],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Creates mutants","Shows ability to use execution guardrails"],"parent":null},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains reference to method used by Windows shell items (API string)","Found virtual disk drive like strings"],"parent":null},{"tactic":"Defense Evasion","technique":"Code Signing","attck_id":"T1553.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","malicious_identifiers_count":1,"malicious_identifiers":["The input sample is signed with an invalid certificate"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["The input sample is signed with a certificate"],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Rootkit","attck_id":"T1014","attck_id_wiki":"https://attack.mitre.org/techniques/T1014","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["References device drivers used by rootkit malware"],"parent":null},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attck_id":"T1027.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Section contains high entropy"],"informative_identifiers_count":1,"informative_identifiers":["YARA signature match – Embedded PE executable"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques"],"parent":null},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attck_id":"T1027.013","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["YARA signature match – Anomalous PE file structure"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Msiexec","attck_id":"T1218.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1218/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Detected msiexec.exe process execution"],"parent":{"technique":"System Binary Proxy Execution","attck_id":"T1218","attck_id_wiki":"https://attack.mitre.org/techniques/T1218"}},{"tactic":"Defense Evasion","technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Drops files inside appdata directory"],"parent":null},{"tactic":"Defense Evasion","technique":"DLL","attck_id":"T1574.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attck_id":"T1036.008","attck_id_wiki":"https://attack.mitre.org/techniques/T1036/008","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036"}},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attck_id":"T1027.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to dynamically determine API calls"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Credential Access","technique":"OS Credential Dumping","attck_id":"T1003","attck_id_wiki":"https://attack.mitre.org/techniques/T1003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"],"parent":null},{"tactic":"Credential Access","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used for keylogging"],"informative_identifiers_count":2,"informative_identifiers":["Found strings related to keylogger","Contains ability to retrieve information about pressed keystrokes (API string)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads configuration files (.ini files)"],"informative_identifiers_count":13,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Contains ability to retrieve path in which Windows is installed (API string)","Contains ability to read files (API string)","Contains ability to enumerate files on disk (API string)","Calls an API typically used for searching a directory for files","Able to determine the valid logical drives on the computer","Reads files","Contains ability to verify if file exist on disk (API string)","Touches files","References Windows file paths for DLLs (possible dropped files)","Able to retrieve the valid logical drives on the computer","Tries to access non-existent files (non-executable)","Touches files in the Windows directory"],"parent":null},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to query system locale information (API string)","Calls an API typically used to retrieve local language"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used to find and list the Windows drive types"],"informative_identifiers_count":24,"informative_identifiers":["Contains ability to retrieve the OS information (API string)","Contains ability to find logical drives of the machine (API string)","Contains ability to query volume/memory size (API string)","Contains ability to retrieve information about the current system (API string)","Contains ability to determine disk drive type (API string)","Contains ability to retrieve a module handle (API string)","Contains reference to mutex-related activity (API string)","Attempts to call APIs to gather system and hardware detail","Contains ability to retrieve the host's architecture (API string)","Calls an API typically used to retrieve OS information","Contains ability to retrieve the specified system metric or system configuration setting (API string)","Queries volume information of an entire harddrive","Calls an API typically used to retrieve information about the current system","Calls an API typically used to retrieve computer name","Contains ability to retrieve the NetBIOS name of the local computer (API string)","Contains ability to read software policies","Contains ability to retrieve windows environment variables","Calls an API typically used to get system version information","Queries volume information","Calls an API typically used to get product type","Reads the active computer name","Reads system-defined device setup information from registry","Reads the cryptographic machine GUID","Reads information about supported languages"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":10,"informative_identifiers":["Contains ability to determine if process is running under WOW64 (API string)","Contains ability to enumerate process and/or its information (API string)","Contains ability to retrieve/open a process (API string)","Calls an API typically used for taking snapshot of the specified processes","Calls an APIs used to retrieve process information","Queries basic information of the specified process","Calls an API typically used to determine if process is running under WOW64","Process launched with changed environment","Spawns new processes","Spawns new processes that are not known child processes"],"parent":null},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment using user register activity","Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Found registry key string for installed applications","Contains registry location strings","Contains ability to query registry keys (API string)","Opens registry keys","Accesses Software Policy Settings","Reads Windows Trust Settings","Queries registry keys"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Calls an API typically used to get handle of currently active window","Calls an API typically used to get active windows title","Calls an API possibly used to retrieve a handle to the foreground window"],"parent":null},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve machine time (API string)","Contains ability to retrieve machine timezone (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Attempts to retrieve the system language code"],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve system language (API string)","Calls an API typically used to retrieve default language settings","Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"Security Software Discovery","attck_id":"T1518.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Loads the debugger/analysis tool module"],"parent":{"technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518"}},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve internet settings (API string)","Contains ability to free the memory used by network management functions (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Network Connections Discovery","attck_id":"T1049","attck_id_wiki":"https://attack.mitre.org/techniques/T1049","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to enumerate network resources (API string)","Contains ability to retrieve IPv4 TCP connection table (API string)"],"parent":null},{"tactic":"Discovery","technique":"Network Share Discovery","attck_id":"T1135","attck_id_wiki":"https://attack.mitre.org/techniques/T1135","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to provide information and utilities for managing network resources (API string)"],"parent":null},{"tactic":"Discovery","technique":"Account Discovery","attck_id":"T1087","attck_id_wiki":"https://attack.mitre.org/techniques/T1087","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve SID for the specified name (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Calls an API typically used to retrieve user name","Contains ability to retrieve usernames and/or user information (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to enumerate service (API string)","Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"Cloud Groups","attck_id":"T1069.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1069/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["May be able to execute Exchange Online Remote PowerShell Modulee"],"parent":{"technique":"Permission Groups Discovery","attck_id":"T1069","attck_id_wiki":"https://attack.mitre.org/techniques/T1069"}},{"tactic":"Discovery","technique":"Local Account","attck_id":"T1087.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1087/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve information about user accounts on a server (API string)","Imports network management related APIs"],"parent":{"technique":"Account Discovery","attck_id":"T1087","attck_id_wiki":"https://attack.mitre.org/techniques/T1087"}},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques"],"parent":null},{"tactic":"Lateral Movement","technique":"Software Deployment Tools","attck_id":"T1072","attck_id_wiki":"https://attack.mitre.org/techniques/T1072","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to software packages activity (Powershell command string)"],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to move file or directory (API string)","Calls an API typically used to create an instance of a named pipe"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to create directories (API string)","Calls an API typically used to create a directory"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API possibly used to take screenshots"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Collection","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Calls an API typically used for keylogging"],"informative_identifiers_count":2,"informative_identifiers":["Found strings related to keylogger","Contains ability to retrieve information about pressed keystrokes (API string)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Writes files in a temp directory","May execute SQL queries","Calls an API typically used to copy file from one location to another"],"parent":null},{"tactic":"Collection","technique":"Data from Information Repositories","attck_id":"T1213","attck_id_wiki":"https://attack.mitre.org/techniques/T1213","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains SQL queries"],"parent":null},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Attempts to call internet-related API for network communication"],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to set options for internet handles (API string)","Contains reference to Windows internet services (API string)","Found string related to HTTP headers"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to create a new HTTP request (API string)","Found potential URL in binary/memory","Found potential IP address in binary/memory","Contains ability to communicate with network (API string)","Contains ability to create a HTTP or FTP session (API string)","Found potential URLs in memory dumps"],"parent":null},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attck_id":"T1095","attck_id_wiki":"https://attack.mitre.org/techniques/T1095","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to communicate with C2 using Sockets (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Writes a PE file header to disc","Drops executable files"],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to write files (API string)","Contains ability to download a file from a URL (API string)","Dropped files","Drops executable files inside temp directory","Drops temp files","Drops files with image extension"],"parent":null},{"tactic":"Command and Control","technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains references to RPC protocol sequence strings"],"parent":null},{"tactic":"Command and Control","technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/techniques/T1132","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform Base64 encoding/decoding"],"parent":null},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"Mail Protocols","attck_id":"T1071.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found mail related domain names"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Steganography","attck_id":"T1001.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1001/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Data Obfuscation","attck_id":"T1001","attck_id_wiki":"https://attack.mitre.org/techniques/T1001"}},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use encryption for command and control traffic"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to reboot/shutdown the operating system (API string)"],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Opens a handle to the specified local process"],"informative_identifiers_count":5,"informative_identifiers":["Able to retrieve/open a process (API string)","Contains ability to terminate a process (API string)","Contains ability to close a handle to a service (API string)","Calls an API used to change the configuration parameters of a service","Calls an API used to open a process handle"],"parent":null},{"tactic":"Impact","technique":"Disk Content Wipe","attck_id":"T1561.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1561/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to format disks"],"parent":{"technique":"Disk Wipe","attck_id":"T1561","attck_id_wiki":"https://attack.mitre.org/techniques/T1561"}},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to cryptographic keys"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-140","type":6,"relevance":3,"name":"Calls an API typically used to find a resource in a module","description":"\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"14\" - (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"18\" - (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"13\" - (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"9\" - (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"10115\" - (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"10111\" - (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"14\" - (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"18\" - (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"13\" - (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"9\" - (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"10115\" - (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"10111\" - (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"14\" - (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"18\" - (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"13\" - (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"9\" - (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"10115\" - (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"FindResourceW\" with parameter \"10111\" - (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-139","type":6,"relevance":3,"name":"Calls an API typically used to load a resource in memory","description":"$39","description_v2":["\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090496'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090560'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090480'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090416'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '1933508608', 'hResInfo': '1936058616'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '128516098', 'hResInfo': '128583184'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '167051265', 'hResInfo': '128845016'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '167051265', 'hResInfo': '167117384'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '19314896'}\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '19314832'}\" (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090496'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090560'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090480'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '115081216', 'hResInfo': '115090416'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '1933508608', 'hResInfo': '1936058616'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '128516098', 'hResInfo': '128583184'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '167051265', 'hResInfo': '128845016'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '167051265', 'hResInfo': '167117384'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '19314896'}\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '19314832'}\" (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$3a","description_v2":["Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjects\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MsgWaitForMultipleObjectsEx\" (Indicator: \"WaitForMultipleObjectsEx\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-306","type":2,"relevance":1,"name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-92","type":2,"relevance":1,"name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegOverridePredefKey\" (Indicator: \"RegOverridePredefKey\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-192","type":2,"relevance":1,"name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-544","type":2,"relevance":1,"name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1569.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-338","type":2,"relevance":1,"name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"AutoTCrypto Desktop.exe\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"AutoTCrypto Desktop.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"ExternalUICleaner.dll\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"ExternalUICleaner.dll\")","description_v2":["Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"AutoTCrypto Desktop.exe\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"AutoTCrypto Desktop.exe\")","file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"ExternalUICleaner.dll\")","file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"ExternalUICleaner.dll\")"],"description_v3":[{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"ExternalUICleaner.dll\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"ExternalUICleaner.dll\")"}],"origin":"File/Memory","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-409","type":2,"relevance":1,"name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824-00000CBF-2369357504\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","description_v2":["Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824-00000CBF-2369357504\")","Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824-00000CBF-2369357504\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"target-152","type":9,"relevance":2,"name":"Detected msiexec.exe process execution","description":"Process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\" (UID: 00000000-00007940)\n","description_v2":["Process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\" (UID: 00000000-00007940)",""],"description_v3":[{"type":"text","value":"Process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\""},{"type":"process","process_uid":"00000000-00007940","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1218.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1218/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"memorydump-8","type":20,"relevance":1,"name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007824.00000001.217774.06DC0000.00000002.mdmp\")","description_v2":["Found PE header \"MZ\" - Source: \"00000000-00007824.00000001.217774.06DC0000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found PE header \"MZ\" - Source: \"00000000-00007824.00000001.217774.06DC0000.00000002.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-145","type":2,"relevance":1,"name":"Found virtual disk drive like strings","description":"$3b","description_v2":["Found string - \\\\.\\pipe\\ToServer; Source: \"AutoTCrypto Desktop.exe\")","Found string - \\\\.\\pipe\\ToServerAdvinst_Extract_C:\\AutoTCryptoDesktop.exe; Source: \"00000000-00007824-00000C57-2367323232\")","Found string - \\\\.\\DISPLAY1; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.09575000.00000004.mdmp\")","Found string - \\\\.\\DISPLAY2; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found string - \\\\.\\DISPLAY3; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found string - \\\\.\\DISPLAY4; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found string - \\\\.\\DISPLAY5; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found string - \\\\.\\DISPLAY6; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found string - \\\\.\\DISPLAY7; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found string - \\\\.\\DISPLAY8; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found string - \\.\\DISPLAY1; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp\")","Found string - \\\\.\\DI; Source: \"00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\pipe\\ToServer; Source: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\ToServerAdvinst_Extract_C:\\AutoTCryptoDesktop.exe; Source: \"00000000-00007824-00000C57-2367323232\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.09575000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY2; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY3; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY4; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY5; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY6; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY7; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DISPLAY8; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\.\\DISPLAY1; Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\DI; Source: \"00000000-00007824.00000001.217774.09575000.00000004.mdmp, 00000000-00007824.00000002.219693.094B0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"module-16","type":10,"relevance":3,"name":"Loads the debugger/analysis tool module","description":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 730B0000","description_v2":["\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 730B0000"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 730B0000"}],"origin":"Loaded Module","attck_id":"T1518.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-148","type":2,"relevance":1,"name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"static-5","type":0,"relevance":10,"name":"PE file contains zero-sized sections","description":"Raw size of \".data\" is zero","description_v2":["Raw size of \".data\" is zero"],"description_v3":[{"type":"text","value":"Raw size of \".data\" is zero"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-438","type":2,"relevance":3,"name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","description_v2":["Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: YARA signature match - AES encryption","Matched sigs: YARA signature match - RC4 Encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to perform AES/RC4 encryption (API string)","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP","Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)","Matched sigs: YARA signature match - AES encryption","Matched sigs: YARA signature match - RC4 Encryption"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform AES/RC4 encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-31","type":15,"relevance":1,"name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Found potential URLs in memory dumps","description_v2":["The analysis shows use of encryption","use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","Matched sigs: YARA signature match - RC4 Encryption","Matched sigs: Contains ability to create a new HTTP request (API string)","Matched sigs: Found potential URL in binary/memory","Matched sigs: Found potential IP address in binary/memory","Matched sigs: Contains ability to communicate with network (API string)","Matched sigs: Contains ability to create a HTTP or FTP session (API string)","Matched sigs: Found potential URLs in memory dumps"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption"},{"type":"linebreak"},{"type":"text","value":"use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - RC4 Encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to create a new HTTP request (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential URL in binary/memory"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential IP address in binary/memory"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to communicate with network (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to create a HTTP or FTP session (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential URLs in memory dumps"}],"origin":"Indicator Combinations","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-661","type":2,"relevance":1,"name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"AutoTCrypto Desktop.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"ExternalUICleaner.dll\")","description_v2":["Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")","Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")","Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"AutoTCrypto Desktop.exe\")","file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"ExternalUICleaner.dll\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"ExternalUICleaner.dll\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-663","type":2,"relevance":1,"name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"AutoTCrypto Desktop.exe\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"AutoTCrypto Desktop.exe\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\[ProductName] [ProductVersion]\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","description_v2":["Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"AutoTCrypto Desktop.exe\")","Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"AutoTCrypto Desktop.exe\")","Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\[ProductName] [ProductVersion]\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\[ProductName] [ProductVersion]\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-201","type":2,"relevance":1,"name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-296","type":6,"relevance":3,"name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"AutoTCryptoDesktop.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-294","type":6,"relevance":3,"name":"Attempts to call APIs to gather system and hardware detail","description":"\"AutoTCryptoDesktop.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetUserNameExW\" with parameters (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetUserNameExW\" with parameters (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetUserNameExW\" with parameters (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-297","type":6,"relevance":3,"name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"AutoTCryptoDesktop.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-142","type":6,"relevance":3,"name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"AutoTCryptoDesktop.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-146","type":6,"relevance":3,"name":"Calls an API typically used to determine if process is running under WOW64","description":"\"AutoTCryptoDesktop.exe\" called \"IsWow64Process\" with parameter \"7824\" - (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"IsWow64Process\" with parameter \"7824\" - (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"IsWow64Process\" with parameter \"7824\" - (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-151","type":6,"relevance":3,"name":"Calls an API typically used to get active windows title","description":"\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Preparing...\" - (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Extracting the main application files...\" - (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Preparing...\" - (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Extracting the main application files...\" - (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Preparing...\" - (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetWindowTextW\" with parameter \"Extracting the main application files...\" - (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-150","type":6,"relevance":5,"name":"Calls an API typically used to get handle of currently active window","description":"\"AutoTCryptoDesktop.exe\" called \"GetActiveWindow\" (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetActiveWindow\" (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetActiveWindow\" (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"AutoTCryptoDesktop.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$3c","description_v2":["\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d58000002000000000011777803a7007803a700000000000950117700007576030000000651117700000000c8f06f0034293b750000000000000000000000000000000020483b7508000000000000005013797634293b7500000000080000007803a700000000000000000000000000000000001800000092dad8cb239b9273e0016f00acf06f0040f16f00c0c89273d68823b8feffffff94fc1577e00ca7000000a600000000000000000083989173b4f06f00000000006400000010000f004051a600000000000f00000000000000600aa700df0ca700e00ca7003051a6000000a600acf06f0094f06f00a6eb1177000000000000000000000000b0473b753f7e38e1ccf06f00 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d58000002000000000000000000a6000a0000000b00000038000000d0077a0000007a00000000000000000000077a00703ba80020000000f4fb6f00307af1000000000000f05b003819a800200000000cfc6f00807af1000000000000f05b003819a80000821a0104fc6f0006f21201d80c260140fc6f001e14130102000000fd13130137696f5a807af100c8941a0100f05b000000000014fc6f00aa161301dcfc6f00b0f3110107e8255bfeffffff68fc6f00aa1613015cfc6f0054fc6f0060fc6f0070fc6f0074fc6f00020000000200000031b8100178fc6f000e1613011c10260100821a0184fc6f004bbb110100821a0190fc6f006fbb110100821a01a8fc6f00947af100 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d580000020000000000a600b42f5c00a0eb6f00650916771200000000000000d06cc77502000000d08ba600b42f5c00c0eb6f00650916771200000000000000d06cc775f0b9107612000000d4eb6f00ae2e13770200000000000000d06cc775e4eb6f00e16cc77502000000000000000cec6f006820a57602000000000000007f29591b70921876000000004cec6f00201baa76ffffffff5cec6f005810a5763c10a5762f29591b709218769cb91076f0b910763cec6f0038ec6f000d0000000d000000504134767cc86d76000000004041347658ec6f00d0ec6f00608da8763bd0876dfeffffff68ec6f00900fa5765041347678ec6f00062527767cc86d765041347684ec6f00 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d5800000200000000006f00c656117708ec6f0000000000e86ba70000000000e86ba7000074137708ec6f0000000000e86ba700a0ec6f00ec7413770c6ca700ecec6f00000000002f7513777a6f4773780000000000000028020000000000007a6f4773000000002e003f73b8ec6f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a103000000000000000000000080000000000000000000000000000000000000000000000000000028020000000000007a6f4773000000002e003f73b8ec6f00b02511770f6238e1b4ec6f0080731377e30100003d0000007a6f4773f4ec6f00 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d58000002000000000000000000000000000000ff6238e190eb6f005072a80090ee6f00b0e81477b7be4996feffffff5072a800787f1277c066a800000000005072a8000a000b00b6c73173000000000000000060a6317370a631735072a8008070a800140000000000000000000000c066a80000000000c0ec6f00d70811775072a800000000008403fe7f00000000f0002a7300000000094d0b3dec6114775fd61077640200005072a80000000000ec66a800180000000000000048ed6f0040080000000000000000000000000000010000003d13bd5044ed6f00350100c0e466a8001ced6f0030a13073feffffff48ed6f00000000000000000000000000640200002ced6f00 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000007a0014000000000000000000a60004087a007b23718f4f5338e10000380030df7e8a20de6f00b0e8147747a34996feffffff30de6f001068a6000000b47530fa9772d4471177c54711779f5038e10000000080c39872a6a271cf24de6f00b4e06f00b0acac72ffffffff64de6f0072fa9772b4e06f007cce897272fa97720100000000000000020000007cce897298de6f000000000080c3987280fa977200000000c0e06f007c0bc97510aad575f2a271cf (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006f00c0c89273d68823b8feffffff9cda6f007e62917330da6f002af0d8cbffffffff00000000e762917301000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffd6a671cf74da6f00c0dd6f00b0acac72ffffffffb4da6f0072fa9772b1ca11777cce897272fa97720100000000000000020000007cce8972e0da6f001ce16f0034f6a90080fa9772f4da6f0040000000d0077a000000000022a671cf (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000130068f4a8007cf4a80020000000d0077a0000007a0020000000000000000000a600183ea8000000000000000000000000000200000020000000c8017a00000000000400000000007a0012000000000000000000a60096a171cf34dd6f00c8dd6f00b0acac72ffffffff70dd6f0072fa9772120000007cce897272fa97720100000000000000020000007cce89729cdd6f002c3daa000000000080fa977210000000fcffffff0000000070dd6f00 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006f0068ce6f0074ce6f0064ce6f0002020000a0ce6f00b005a67542d26f009002a675c105a67514d26f00ffffffffd8ce6f00dcce6f000000000068ce6f00be391177287ba900000000000000000000000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f000c7daa0080fa9772a294c6752900000090b4a70000000000dab271cf (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000ec02a60018ce6f000cd06f000000a600000000000000000000000000000000000000000000000000200000000d000800a837aa00d03aaa00b1ca1177d03aaa00000000002800000042009d728ccf6f00000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f003c81aa0080fa9772a294c6752a00000090b1a70000000000dab271cf (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c000000de7faa0034d06f00caff0f77de7faa0028ce6f005c000000c07faa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f007c82aa0080fa9772a294c67526000000d884aa0000000000dab271cf (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000001177e74138e100100000081000000000a60031006f00574338e174cd6f00d4cd6f009ce26f005c0000004f00004f34d06f00caff0f770699aa0028ce6f005c00000002000002d8d06f00541f004b00000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f00ecc5aa0080fa9772a294c6752900000038bfaa0000000000dab271cf (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c0000002e83aa0034d06f00caff0f772e83aa0028ce6f005c0000001083aa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f00ecc5aa0080fa9772a294c675270000005089aa0000000000dab271cf (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c0000002e83aa0034d06f00caff0f772e83aa0028ce6f005c0000001083aa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f002cd4aa0080fa9772a294c6752a00000078bbaa0000000000dab271cf (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d58000002000000000011777803a7007803a700000000000950117700007576030000000651117700000000c8f06f0034293b750000000000000000000000000000000020483b7508000000000000005013797634293b7500000000080000007803a700000000000000000000000000000000001800000092dad8cb239b9273e0016f00acf06f0040f16f00c0c89273d68823b8feffffff94fc1577e00ca7000000a600000000000000000083989173b4f06f00000000006400000010000f004051a600000000000f00000000000000600aa700df0ca700e00ca7003051a6000000a600acf06f0094f06f00a6eb1177000000000000000000000000b0473b753f7e38e1ccf06f00 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d58000002000000000000000000a6000a0000000b00000038000000d0077a0000007a00000000000000000000077a00703ba80020000000f4fb6f00307af1000000000000f05b003819a800200000000cfc6f00807af1000000000000f05b003819a80000821a0104fc6f0006f21201d80c260140fc6f001e14130102000000fd13130137696f5a807af100c8941a0100f05b000000000014fc6f00aa161301dcfc6f00b0f3110107e8255bfeffffff68fc6f00aa1613015cfc6f0054fc6f0060fc6f0070fc6f0074fc6f00020000000200000031b8100178fc6f000e1613011c10260100821a0184fc6f004bbb110100821a0190fc6f006fbb110100821a01a8fc6f00947af100 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d580000020000000000a600b42f5c00a0eb6f00650916771200000000000000d06cc77502000000d08ba600b42f5c00c0eb6f00650916771200000000000000d06cc775f0b9107612000000d4eb6f00ae2e13770200000000000000d06cc775e4eb6f00e16cc77502000000000000000cec6f006820a57602000000000000007f29591b70921876000000004cec6f00201baa76ffffffff5cec6f005810a5763c10a5762f29591b709218769cb91076f0b910763cec6f0038ec6f000d0000000d000000504134767cc86d76000000004041347658ec6f00d0ec6f00608da8763bd0876dfeffffff68ec6f00900fa5765041347678ec6f00062527767cc86d765041347684ec6f00 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d5800000200000000006f00c656117708ec6f0000000000e86ba70000000000e86ba7000074137708ec6f0000000000e86ba700a0ec6f00ec7413770c6ca700ecec6f00000000002f7513777a6f4773780000000000000028020000000000007a6f4773000000002e003f73b8ec6f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a103000000000000000000000080000000000000000000000000000000000000000000000000000028020000000000007a6f4773000000002e003f73b8ec6f00b02511770f6238e1b4ec6f0080731377e30100003d0000007a6f4773f4ec6f00 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d58000002000000000000000000000000000000ff6238e190eb6f005072a80090ee6f00b0e81477b7be4996feffffff5072a800787f1277c066a800000000005072a8000a000b00b6c73173000000000000000060a6317370a631735072a8008070a800140000000000000000000000c066a80000000000c0ec6f00d70811775072a800000000008403fe7f00000000f0002a7300000000094d0b3dec6114775fd61077640200005072a80000000000ec66a800180000000000000048ed6f0040080000000000000000000000000000010000003d13bd5044ed6f00350100c0e466a8001ced6f0030a13073feffffff48ed6f00000000000000000000000000640200002ced6f00 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000007a0014000000000000000000a60004087a007b23718f4f5338e10000380030df7e8a20de6f00b0e8147747a34996feffffff30de6f001068a6000000b47530fa9772d4471177c54711779f5038e10000000080c39872a6a271cf24de6f00b4e06f00b0acac72ffffffff64de6f0072fa9772b4e06f007cce897272fa97720100000000000000020000007cce897298de6f000000000080c3987280fa977200000000c0e06f007c0bc97510aad575f2a271cf (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006f00c0c89273d68823b8feffffff9cda6f007e62917330da6f002af0d8cbffffffff00000000e762917301000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffd6a671cf74da6f00c0dd6f00b0acac72ffffffffb4da6f0072fa9772b1ca11777cce897272fa97720100000000000000020000007cce8972e0da6f001ce16f0034f6a90080fa9772f4da6f0040000000d0077a000000000022a671cf (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d58000002000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000130068f4a8007cf4a80020000000d0077a0000007a0020000000000000000000a600183ea8000000000000000000000000000200000020000000c8017a00000000000400000000007a0012000000000000000000a60096a171cf34dd6f00c8dd6f00b0acac72ffffffff70dd6f0072fa9772120000007cce897272fa97720100000000000000020000007cce89729cdd6f002c3daa000000000080fa977210000000fcffffff0000000070dd6f00 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000006f0068ce6f0074ce6f0064ce6f0002020000a0ce6f00b005a67542d26f009002a675c105a67514d26f00ffffffffd8ce6f00dcce6f000000000068ce6f00be391177287ba900000000000000000000000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f000c7daa0080fa9772a294c6752900000090b4a70000000000dab271cf (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000000000ec02a60018ce6f000cd06f000000a600000000000000000000000000000000000000000000000000200000000d000800a837aa00d03aaa00b1ca1177d03aaa00000000002800000042009d728ccf6f00000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f003c81aa0080fa9772a294c6752a00000090b1a70000000000dab271cf (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c000000de7faa0034d06f00caff0f77de7faa0028ce6f005c000000c07faa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f007c82aa0080fa9772a294c67526000000d884aa0000000000dab271cf (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d0000001177e74138e100100000081000000000a60031006f00574338e174cd6f00d4cd6f009ce26f005c0000004f00004f34d06f00caff0f770699aa0028ce6f005c00000002000002d8d06f00541f004b00000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f00ecc5aa0080fa9772a294c6752900000038bfaa0000000000dab271cf (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c0000002e83aa0034d06f00caff0f772e83aa0028ce6f005c0000001083aa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f00ecc5aa0080fa9772a294c675270000005089aa0000000000dab271cf (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d00000033003800310032003300390031003000300031006f00574338e174cd6f00d4cd6f009ce26f005c0000002e83aa0034d06f00caff0f772e83aa0028ce6f005c0000001083aa00d8d06f00f2ff0f7700000000000000008eb271cf3cce6f0088d16f00b0acac72ffffffff7cce6f0072fa977254ce6f007cce897272fa97720100000000000000020000007cce8972a8ce6f00e4d46f002cd4aa0080fa9772a294c6752a00000078bbaa0000000000dab271cf (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-222","type":6,"relevance":2,"name":"Calls an API typically used to retrieve OS information","description":"\"AutoTCryptoDesktop.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000077a0000007a00000000000000000000000000003da800000000000000000060ff6e000200000010000000c0017a00000000000200000000007a0001000000080000000000a600dc0a7a0000000000d80a7a00d8ed6f00feba1177080000000000000008000000b62ab7cb1cf06f00da91f7720000a6000800000001000000 (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000077a0000007a00000000000000000000000000003da800000000000000000060ff6e000200000010000000c0017a00000000000200000000007a0001000000080000000000a600dc0a7a0000000000d80a7a00d8ed6f00feba1177080000000000000008000000b62ab7cb1cf06f00da91f7720000a6000800000001000000 (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d5800000200000000077a0000007a00000000000000000000000000003da800000000000000000060ff6e000200000010000000c0017a00000000000200000000007a0001000000080000000000a600dc0a7a0000000000d80a7a00d8ed6f00feba1177080000000000000008000000b62ab7cb1cf06f00da91f7720000a6000800000001000000 (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-149","type":6,"relevance":3,"name":"Calls an API typically used to retrieve default language settings","description":"\"AutoTCryptoDesktop.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-147","type":6,"relevance":3,"name":"Calls an API typically used to retrieve local language","description":"\"AutoTCryptoDesktop.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetLocaleInfoW\" with parameter \"1065\" - (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetLocaleInfoW\" with parameter \"1065\" - (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetLocaleInfoW\" with parameter \"1065\" - (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-189","type":0,"relevance":5,"name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ExternalUICleaner.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: MSIFA0B.tmp]","description_v2":["Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ExternalUICleaner.dll]","Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: MSIFA0B.tmp]"],"description_v3":[{"type":"text","value":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ExternalUICleaner.dll]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: MSIFA0B.tmp]"}],"origin":"Static Parser","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-450","type":2,"relevance":1,"name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-433","type":2,"relevance":1,"name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0\" (Indicator: \"select * from \"; File: \"AutoTCrypto Desktop.exe\")\n Found string \"SELECT * FROM `Error` WHERE Error = 15\" (Indicator: \"select * from \"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","description_v2":["Found string \"SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0\" (Indicator: \"select * from \"; File: \"AutoTCrypto Desktop.exe\")","Found string \"SELECT * FROM `Error` WHERE Error = 15\" (Indicator: \"select * from \"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"SELECT * FROM `InstallUISequence` WHERE `Sequence` > 0\" (Indicator: \"select * from \"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SELECT * FROM `Error` WHERE Error = 15\" (Indicator: \"select * from \"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-193","type":2,"relevance":1,"name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-248","type":2,"relevance":1,"name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-312","type":2,"relevance":1,"name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-171","type":2,"relevance":1,"name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-167","type":2,"relevance":1,"name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-557","type":2,"relevance":1,"name":"Contains ability to retrieve windows environment variables","description":"Found string \"%USERNAME%\" (Indicator: \"%username%\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","description_v2":["Found string \"%USERNAME%\" (Indicator: \"%username%\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"%USERNAME%\" (Indicator: \"%username%\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-140","type":2,"relevance":1,"name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"$3d","description_v2":["\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\\" at 00000000-00007824-00000C17-2370475691","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_down.png\" at 00000000-00007824-00000C17-2371975750","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_hot.png\" at 00000000-00007824-00000C17-2371988091","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_hot.png\" at 00000000-00007824-00000C17-2371990872","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_normal.png\" at 00000000-00007824-00000C17-2371993800","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_inactive.png\" at 00000000-00007824-00000C17-2371996633","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_down.png\" at 00000000-00007824-00000C17-2371999690","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_hot.png\" at 00000000-00007824-00000C17-2372002403","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_hot.png\" at 00000000-00007824-00000C17-2372005099","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_normal.png\" at 00000000-00007824-00000C17-2372007969","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_inactive.png\" at 00000000-00007824-00000C17-2372010758","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_left.bmp\" at 00000000-00007824-00000C17-2372013716","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_left_inactive.bmp\" at 00000000-00007824-00000C17-2372016969","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_mid.bmp\" at 00000000-00007824-00000C17-2372019836","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_mid_inactive.bmp\" at 00000000-00007824-00000C17-2372022871","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_caption.bmp\" at 00000000-00007824-00000C17-2372026610","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_caption_inactive.bmp\" at 00000000-00007824-00000C17-2372029539","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_right.bmp\" at 00000000-00007824-00000C17-2372032619","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_right_inactive.bmp\" at 00000000-00007824-00000C17-2372035593","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_left.bmp\" at 00000000-00007824-00000C17-2372038656","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_left_inactive.bmp\" at 00000000-00007824-00000C17-2372041474","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_right.bmp\" at 00000000-00007824-00000C17-2372044255","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_right_inactive.bmp\" at 00000000-00007824-00000C17-2372047346","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_bottom_left.bmp\" at 00000000-00007824-00000C17-2372050425","\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_bottom_left_inactive.bmp\" at 00000000-00007824-00000C17-2372053432"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\\" at 00000000-00007824-00000C17-2370475691"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_down.png\" at 00000000-00007824-00000C17-2371975750"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_hot.png\" at 00000000-00007824-00000C17-2371988091"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_hot.png\" at 00000000-00007824-00000C17-2371990872"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_normal.png\" at 00000000-00007824-00000C17-2371993800"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_close_inactive.png\" at 00000000-00007824-00000C17-2371996633"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_down.png\" at 00000000-00007824-00000C17-2371999690"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_hot.png\" at 00000000-00007824-00000C17-2372002403"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_hot.png\" at 00000000-00007824-00000C17-2372005099"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_normal.png\" at 00000000-00007824-00000C17-2372007969"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\sys_min_inactive.png\" at 00000000-00007824-00000C17-2372010758"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_left.bmp\" at 00000000-00007824-00000C17-2372013716"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_left_inactive.bmp\" at 00000000-00007824-00000C17-2372016969"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_mid.bmp\" at 00000000-00007824-00000C17-2372019836"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_mid_inactive.bmp\" at 00000000-00007824-00000C17-2372022871"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_caption.bmp\" at 00000000-00007824-00000C17-2372026610"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_caption_inactive.bmp\" at 00000000-00007824-00000C17-2372029539"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_right.bmp\" at 00000000-00007824-00000C17-2372032619"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_top_right_inactive.bmp\" at 00000000-00007824-00000C17-2372035593"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_left.bmp\" at 00000000-00007824-00000C17-2372038656"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_left_inactive.bmp\" at 00000000-00007824-00000C17-2372041474"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_right.bmp\" at 00000000-00007824-00000C17-2372044255"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_right_inactive.bmp\" at 00000000-00007824-00000C17-2372047346"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_bottom_left.bmp\" at 00000000-00007824-00000C17-2372050425"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\frame_bottom_left_inactive.bmp\" at 00000000-00007824-00000C17-2372053432"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-39","type":6,"relevance":8,"name":"Queries volume information of an entire harddrive","description":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\\" at 00000000-00007824-00000C17-2370475691","description_v2":["\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\\" at 00000000-00007824-00000C17-2370475691"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries volume information of \"C:\\\" at 00000000-00007824-00000C17-2370475691"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-191","type":2,"relevance":1,"name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-18","type":3,"relevance":10,"name":"Accesses Software Policy Settings","description":"$3e","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-17","type":3,"relevance":10,"name":"Accesses System Certificates Settings","description":"$3f","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-123","type":6,"relevance":3,"name":"Calls an API typically used to copy file from one location to another","description":"\"AutoTCryptoDesktop.exe\" called \"CopyFileW\" to copy %WINDIR%\\system32\\wininet.dll to new location %TEMP%\\shi84C8.tmp (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"CopyFileW\" to copy %WINDIR%\\system32\\wininet.dll to new location %TEMP%\\shi84C8.tmp (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CopyFileW\" to copy %WINDIR%\\system32\\wininet.dll to new location %TEMP%\\shi84C8.tmp (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-122","type":6,"relevance":3,"name":"Calls an API typically used to create a directory","description":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\Users (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\Users\\%OSUSER% (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%USERPROFILE%\\AppData (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%USERPROFILE%\\AppData\\Roaming (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3 (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\AI_EXTUI_BIN_7824 (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\Users (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\Users\\%OSUSER% (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%USERPROFILE%\\AppData (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%USERPROFILE%\\AppData\\Roaming (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\AI_EXTUI_BIN_7824 (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\Users (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\C:\\Users\\%OSUSER% (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%USERPROFILE%\\AppData (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%USERPROFILE%\\AppData\\Roaming (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\AI_EXTUI_BIN_7824 (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-138","type":6,"relevance":3,"name":"Calls an API typically used to create an instance of a named pipe","description":"\"AutoTCryptoDesktop.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\ToServerAdvinst_Extract_C:\\AutoTCryptoDesktop.exe\" - (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\ToServerAdvinst_Extract_C:\\AutoTCryptoDesktop.exe\" - (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\ToServerAdvinst_Extract_C:\\AutoTCryptoDesktop.exe\" - (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$40","description_v2":["\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\psapi.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\WindowsCodecs.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\bcrypt.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msi.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\USP10.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msls31.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\mpr.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\uxtheme.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\profapi.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\gdiplus.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\userenv.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\dwmapi.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\davhlpr.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ole32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\oleaut32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\comctl32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shell32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\gdi32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\user32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\comdlg32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msimg32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\dbghelp.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\wininet.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\urlmon.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\cabinet.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\propsys.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\rsaenh.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\apphelp.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msasn1.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\crypt32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\wintrust.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shlwapi.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\lpk.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\setupapi.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\usp10.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msihnd.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shcore.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\cryptsp.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\secur32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\samcli.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ws2_32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\netapi32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\netutils.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\srvcli.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\wkscli.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter gdiplus.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter COMCTL32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\RICHED20.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter SHELL32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter \\\\?\\%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter atlthunk.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter ComCtl32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter msi.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter Comctl32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\KERNEL32.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\VERSION.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\OLE32.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter Ntdll.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\TSAPPCMP.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter COMCTL32 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\SHLWAPI.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter MsiMsg.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\WLDP.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\ADVAPI32.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\APPHELP.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\sxs.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\MSCOREE.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\SHELL32.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\NTDLL.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter MsiHnd.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter KERNEL32 (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter DWMAPI (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\PCACLI.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\USER32.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\RPCRT4.DLL (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter dwmapi.dll (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\psapi.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\WindowsCodecs.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\bcrypt.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msi.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\USP10.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msls31.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\mpr.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\uxtheme.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\profapi.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\gdiplus.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\userenv.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\dwmapi.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\davhlpr.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ole32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\oleaut32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter imm32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\comctl32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shell32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\gdi32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\user32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\comdlg32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msimg32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\dbghelp.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\wininet.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\urlmon.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\cabinet.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\propsys.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\rsaenh.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\apphelp.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msasn1.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\crypt32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\wintrust.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shlwapi.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\lpk.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\setupapi.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\usp10.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\msihnd.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\shcore.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\cryptsp.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\secur32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\samcli.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\ws2_32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\netapi32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\netutils.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\srvcli.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\wkscli.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter gdiplus.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter COMCTL32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\RICHED20.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter SHELL32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter \\\\?\\%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter atlthunk.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter ComCtl32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter msi.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter Comctl32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\KERNEL32.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\VERSION.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\OLE32.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter Ntdll.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\TSAPPCMP.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter COMCTL32 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\SHLWAPI.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter MsiMsg.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\WLDP.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\ADVAPI32.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\APPHELP.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\sxs.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\MSCOREE.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\SHELL32.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\NTDLL.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter MsiHnd.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter KERNEL32 (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter DWMAPI (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\PCACLI.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\USER32.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\RPCRT4.DLL (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"LoadLibrary\" with a parameter dwmapi.dll (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"\"AutoTCryptoDesktop.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"C:\\ReleaseAI\\win\\Release\\stubs\\x86\\ExternalUi.pdb\"","description_v2":["\"C:\\ReleaseAI\\win\\Release\\stubs\\x86\\ExternalUi.pdb\""],"description_v3":[{"type":"text","value":"\"C:\\ReleaseAI\\win\\Release\\stubs\\x86\\ExternalUi.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-16","type":2,"relevance":2,"name":"Contains SQL queries","description":"$41","description_v2":["\"INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES ('\" (Source: AutoTCrypto Desktop.exe, Indicator: \"insert into `controlevent` (`dialog_`, `control_`,`event`,`argument`, `condition`, `ordering`) values ('\")","$42","`HCentering`","`VCentering`","`Width`","`Height`","`Attributes`","`Title`","`Control_First`","`Control_Default`","`Control_Cancel`","0","0","0","0 FROM `Dialog` WHERE `Dialog`=?\" (Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, Indicator: \"select `dialog`","`hcentering`","`vcentering`","`width`","`height`","`attributes`","`title`","`control_first`","`control_default`","`control_cancel`","0","0","0","0 from `dialog` where `dialog`=?\"), \"SELECT `Dialog_`","`Control_`","`Event`","`Argument`","`Condition` FROM `ControlEvent` WHERE `Dialog_`='LanguageDlg' AND `Control_`='LangComboBox' ORDER BY `Ordering`\" (Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, Indicator: \"select `dialog_`","`control_`","`event`","`argument`","`condition` from `controlevent` where `dialog_`='languagedlg' and `control_`='langcombobox' order by `ordering`\"), \"SELECT * FROM `Error` WHERE Error = 15\" (Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp, Indicator: \"select * from `error` where error = 15\"), \"SELECT `Action`","`Condition`","`Sequence` FROM `BootstrapperUISequence` WHERE `Sequence` >= 0 ORDER BY `Sequence`\" (Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp, Indicator: \"select `action`","`condition`","`sequence` from `bootstrapperuisequence` where `sequence` >= 0 order by `sequence`\")"],"description_v3":[{"type":"text","value":"\"INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES ('\" (Source: AutoTCrypto Desktop.exe, Indicator: \"insert into `controlevent` (`dialog_`, `control_`,`event`,`argument`, `condition`, `ordering`) values ('\")"},{"type":"linebreak"},{"type":"text","value":"$43"},{"type":"linebreak"},{"type":"text","value":"`HCentering`"},{"type":"linebreak"},{"type":"text","value":"`VCentering`"},{"type":"linebreak"},{"type":"text","value":"`Width`"},{"type":"linebreak"},{"type":"text","value":"`Height`"},{"type":"linebreak"},{"type":"text","value":"`Attributes`"},{"type":"linebreak"},{"type":"text","value":"`Title`"},{"type":"linebreak"},{"type":"text","value":"`Control_First`"},{"type":"linebreak"},{"type":"text","value":"`Control_Default`"},{"type":"linebreak"},{"type":"text","value":"`Control_Cancel`"},{"type":"linebreak"},{"type":"text","value":"0"},{"type":"linebreak"},{"type":"text","value":"0"},{"type":"linebreak"},{"type":"text","value":"0"},{"type":"linebreak"},{"type":"text","value":"0 FROM `Dialog` WHERE `Dialog`=?\" (Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, Indicator: \"select `dialog`"},{"type":"linebreak"},{"type":"text","value":"`hcentering`"},{"type":"linebreak"},{"type":"text","value":"`vcentering`"},{"type":"linebreak"},{"type":"text","value":"`width`"},{"type":"linebreak"},{"type":"text","value":"`height`"},{"type":"linebreak"},{"type":"text","value":"`attributes`"},{"type":"linebreak"},{"type":"text","value":"`title`"},{"type":"linebreak"},{"type":"text","value":"`control_first`"},{"type":"linebreak"},{"type":"text","value":"`control_default`"},{"type":"linebreak"},{"type":"text","value":"`control_cancel`"},{"type":"linebreak"},{"type":"text","value":"0"},{"type":"linebreak"},{"type":"text","value":"0"},{"type":"linebreak"},{"type":"text","value":"0"},{"type":"linebreak"},{"type":"text","value":"0 from `dialog` where `dialog`=?\"), \"SELECT `Dialog_`"},{"type":"linebreak"},{"type":"text","value":"`Control_`"},{"type":"linebreak"},{"type":"text","value":"`Event`"},{"type":"linebreak"},{"type":"text","value":"`Argument`"},{"type":"linebreak"},{"type":"text","value":"`Condition` FROM `ControlEvent` WHERE `Dialog_`='LanguageDlg' AND `Control_`='LangComboBox' ORDER BY `Ordering`\" (Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp, Indicator: \"select `dialog_`"},{"type":"linebreak"},{"type":"text","value":"`control_`"},{"type":"linebreak"},{"type":"text","value":"`event`"},{"type":"linebreak"},{"type":"text","value":"`argument`"},{"type":"linebreak"},{"type":"text","value":"`condition` from `controlevent` where `dialog_`='languagedlg' and `control_`='langcombobox' order by `ordering`\"), \"SELECT * FROM `Error` WHERE Error = 15\" (Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp, Indicator: \"select * from `error` where error = 15\"), \"SELECT `Action`"},{"type":"linebreak"},{"type":"text","value":"`Condition`"},{"type":"linebreak"},{"type":"text","value":"`Sequence` FROM `BootstrapperUISequence` WHERE `Sequence` >= 0 ORDER BY `Sequence`\" (Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp, Indicator: \"select `action`"},{"type":"linebreak"},{"type":"text","value":"`condition`"},{"type":"linebreak"},{"type":"text","value":"`sequence` from `bootstrapperuisequence` where `sequence` >= 0 order by `sequence`\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-242","type":2,"relevance":1,"name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-204","type":2,"relevance":1,"name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-307","type":2,"relevance":1,"name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKeyTransacted\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKeyTransacted\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCreateKeyTransactedW\" (Indicator: \"RegCreateKeyTransacted\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCreateKeyA\" (Indicator: \"RegCreateKey\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-79","type":0,"relevance":1,"name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: AutoTCrypto Desktop.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: AutoTCrypto Desktop.aiui)","description_v2":["Found GetProcAddress() and LoadLibraryA() in an import section (Source: AutoTCrypto Desktop.exe)","Found GetProcAddress() and LoadLibraryA() in an import section (Source: AutoTCrypto Desktop.aiui)"],"description_v3":[{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: AutoTCrypto Desktop.exe)"},{"type":"linebreak"},{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: AutoTCrypto Desktop.aiui)"}],"origin":"Static Parser","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$44","description_v2":["Found reference to API (Indicator: \"GetStdHandle\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FlushInstructionCache\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CloseHandle\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ConnectNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EncodePointer\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetLastError\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DeleteFileW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FileTimeToSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetProcessAffinityMask\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateEventW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFileType\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetTempPathW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsValidCodePage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CopyFileExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateProcessW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WriteFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetConsoleMode\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"lstrcmpW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalMemoryStatus\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetTempFileNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetDateFormatW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateNamedPipeW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WritePrivateProfileStringW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LoadResource\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VerifyVersionInfoW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TlsFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LoadLibraryW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LockResource\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetEndOfFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RaiseException\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RemoveDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateFileW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DecodePointer\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FreeLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SystemTimeToFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ResetEvent\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetCurrentDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetProcessHeap\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"HeapReAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LoadLibraryA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalLock\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MulDiv\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"Process32NextW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFileSize\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RtlUnwind\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"PeekNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetLocalTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OpenEventW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CopyFileW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalUnlock\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SleepConditionVariableSRW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetStringTypeW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"QueryPerformanceFrequency\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetConsoleTextAttribute\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VirtualFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ExitThread\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FindNextFileW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsValidLocale\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"Process32FirstW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EnumResourceLanguagesW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InterlockedPushEntrySList\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCPInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetPrivateProfileSectionNamesW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"HeapSize\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"Sleep\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FindClose\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FindFirstFileW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCommandLineW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InterlockedPopEntrySList\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetStdHandle\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VirtualAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetVersionExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VirtualQuery\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TlsAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WakeAllConditionVariable\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetLogicalDriveStringsW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateSemaphoreW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EnumSystemLocalesW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsWow64Process\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SizeofResource\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFinalPathNameByHandleW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LoadLibraryExA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetTickCount\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"HeapDestroy\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"HeapAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InitializeSListHead\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetProcAddress\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetPrivateProfileStringW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OutputDebugStringW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FormatMessageW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CompareStringW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetOEMCP\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CompareStringEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TerminateThread\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"HeapFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetEvent\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ReadFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetShortPathNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TlsSetValue\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCommandLineA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"lstrcpynW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetEnvironmentVariableW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LCMapStringW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ReleaseSemaphore\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TerminateProcess\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LocalAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FindResourceExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VerSetConditionMask\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CompareFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetACP\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WriteConsoleW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LocalFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FindResourceW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TlsGetValue\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ReadConsoleW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateThread\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetFilePointer\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VirtualProtect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateEventExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetLastError\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"lstrlenW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MoveFileW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ExitProcess\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCurrentThread\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"lstrcmpiW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LCMapStringEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetUserDefaultLangID\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FlsAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FlsFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FlsGetValue\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FlsSetValue\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"AreFileApisANSI\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EnumSystemLocalesEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetDateFormatEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetLocaleInfoEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetTimeFormatEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsValidLocaleName\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LCIDToLocaleName\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetSearchPathMode\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegDeleteKeyExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetDefaultDllDirectories\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsWow64Process2\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetNativeSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ConvertStringSidToSidW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SHGetFolderPathW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSystemDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetUserDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SHGetSpecialFolderPathW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalMemoryStatusEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetKeyState\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetActiveWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DestroyAcceleratorTable\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetDesktopWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ReleaseDC\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetDC\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InvalidateRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetClientRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FillRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ReleaseCapture\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetCapture\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MoveWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ScreenToClient\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetParent\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ClientToScreen\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateAcceleratorTableW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DestroyWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateWindowExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"UnregisterClassW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DefWindowProcW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LoadCursorW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RedrawWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetWindowPos\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CharNextW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSysColor\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetFocus\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFocus\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsChild\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"BeginPaint\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetWindowTextW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetWindowTextW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetWindowTextLengthW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MapWindowPoints\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ShowWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetWindowRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsWindowVisible\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetWindowDC\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LookupIconIdFromDirectoryEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateIconFromResourceEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"KillTimer\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetTimer\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EqualRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CopyRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsWindowEnabled\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MessageBoxW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SendMessageA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MessageBeep\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"PtInRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetForegroundWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ExitWindowsEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsRectEmpty\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IntersectRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DestroyIcon\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DispatchMessageW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TranslateMessage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"PeekMessageW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCursorPos\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetCursorPos\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EnableWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"PostQuitMessage\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LoadImageW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSysColorBrush\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetCursor\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TranslateAcceleratorW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DestroyCursor\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetWindowRgn\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsZoomed\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OffsetRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetAsyncKeyState\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DrawIconEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LoadStringW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"TrackPopupMenu\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"AppendMenuW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreatePopupMenu\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DestroyMenu\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetProcessDpiAwarenessContext\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SystemParametersInfoW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetScrollInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetScrollPos\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DrawEdge\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetScrollInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetScrollPos\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetCapture\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"UpdateWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InflateRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DrawFocusRect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DrawFrameControl\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetDeviceCaps\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetObjectW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetStockObject\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DeleteDC\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"BitBlt\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DeleteObject\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SelectObject\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateCompatibleBitmap\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateCompatibleDC\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateSolidBrush\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreatePatternBrush\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateFontIndirectW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegCloseKey\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OpenProcessToken\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LookupPrivilegeValueW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"AdjustTokenPrivileges\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegOpenKeyExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegQueryValueExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegDeleteKeyW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegQueryInfoKeyW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegEnumKeyExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegSetValueExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegCreateKeyExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegDeleteValueW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SHGetFileInfoW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ShellExecuteW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ShellExecuteExW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoTaskMemAlloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoTaskMemFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"StringFromGUID2\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CreateStreamOnHGlobal\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoCreateInstance\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoGetClassObject\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CLSIDFromString\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OleUninitialize\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OleInitialize\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoInitialize\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoUninitialize\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoInitializeEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoTaskMemRealloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"PathFileExistsW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"PathIsDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"PathAddBackslashW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"PathAppendW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetFileVersionInfoW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VerQueryValueW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetCrackUrlW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetCloseHandle\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetSetOptionW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetOpenW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetGetLastResponseInfoW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetReadFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetQueryDataAvailable\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FtpGetFileSize\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetQueryOptionW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"HttpQueryInfoW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InternetConnectW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"HttpOpenRequestW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"HttpSendRequestW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FtpOpenFileW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FtpCommandW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WNetAddConnection2W\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WNetGetUniversalNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MsgWaitForMultipleObjectsEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EnumWindows\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"wsprintfW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSystemMenu\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ModifyMenuW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetIconInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetTokenInformation\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"AllocateAndInitializeSid\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EqualSid\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FreeSid\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSecurityDescriptorDacl\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetEntriesInAclW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InitializeSecurityDescriptor\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetSecurityDescriptorDacl\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LookupAccountNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LookupAccountSidW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegEnumValueW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CloseServiceHandle\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OpenSCManagerW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"IsTextUnicode\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegOpenKeyExA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegEnumValueA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegCreateKeyW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetUserNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegDeleteKeyA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegCreateKeyA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegSetValueExA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegOpenKeyA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegQueryValueExA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegDeleteValueA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SHGetPathFromIDListW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SHGetMalloc\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SHGetSpecialFolderLocation\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoCreateGuid\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"NetLocalGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"NetApiBufferFree\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ConvertSecurityDescriptorToStringSecurityDescriptorW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CoCreateFreeThreadedMarshaler\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MessageBox\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SeShutdownPrivilege\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InterlockedFlushSList\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetOpenFileNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetComputerNameW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SHFileOperationW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"RegOverridePredefKey\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OpenServiceW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"QueryServiceStatusEx\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"StartServiceW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LogonUserW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSidSubAuthority\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LsaClose\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"QueryServiceObjectSecurity\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"QueryServiceStatus\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSidSubAuthorityCount\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EnumServicesStatusW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"InitializeSid\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ConvertSidToStringSidW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LsaOpenPolicy\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LsaAddAccountRights\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ControlService\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSidIdentifierAuthority\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SetServiceObjectSecurity\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetSidLengthRequired\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"LsaNtStatusToWinError\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CertGetNameStringW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CertFreeCertificateContext\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetTcpTable\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OpenMutexW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"lstrcpyW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalAddAtomW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ReadProcessMemory\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"lstrcatW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalFindAtomW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"OpenProcess\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DuplicateHandle\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetDiskFreeSpaceW\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GlobalDeleteAtom\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"FormatMessageA\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"NetGetDCName\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"NetUserGetInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"NetQueryDisplayInformation\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"NetGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"NetUserModalsGet\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"GetErrorInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SysAllocString\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VariantInit\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"VariantClear\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SysStringLen\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SysFreeString\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"SHGetKnownFolderPath\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"EnumChildWindows\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"DeleteMenu\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WSAStartup\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"htonl\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"gethostbyname\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"ntohs\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"WSACleanup\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00007824.00000000.215853.00A60000.00000004.mdmp\")","Found reference to API (Indicator: \"DisplayVersion\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushInstructionCache\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConnectNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FileTimeToSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessAffinityMask\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidCodePage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateProcessW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrcmpW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalMemoryStatus\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempFileNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateNamedPipeW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WritePrivateProfileStringW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadResource\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerifyVersionInfoW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockResource\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RemoveDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ResetEvent\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCurrentDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalLock\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MulDiv\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32NextW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSize\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlUnwind\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocalTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenEventW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalUnlock\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableSRW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStringTypeW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceFrequency\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleTextAttribute\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitThread\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocale\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32FirstW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumResourceLanguagesW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedPushEntrySList\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCPInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetPrivateProfileSectionNamesW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedPopEntrySList\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetStdHandle\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualQuery\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeAllConditionVariable\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLogicalDriveStringsW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSemaphoreW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWow64Process\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SizeofResource\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFinalPathNameByHandleW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapDestroy\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetPrivateProfileStringW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OutputDebugStringW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOEMCP\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateThread\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetShortPathNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrcpynW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariableW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSemaphore\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerSetConditionMask\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetACP\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrlenW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThread\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrcmpiW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLangID\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsGetValue\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsSetValue\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AreFileApisANSI\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocaleName\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCIDToLocaleName\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetSearchPathMode\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegDeleteKeyExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetDefaultDllDirectories\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWow64Process2\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNativeSystemInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConvertStringSidToSidW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetFolderPathW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultUILanguage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetSpecialFolderPathW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalMemoryStatusEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyState\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetActiveWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyAcceleratorTable\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDesktopWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseDC\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDC\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InvalidateRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClientRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FillRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseCapture\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCapture\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ScreenToClient\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetParent\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ClientToScreen\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateAcceleratorTableW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWindowExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterClassW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DefWindowProcW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadCursorW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RedrawWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPos\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharNextW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSysColor\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFocus\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFocus\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsChild\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BeginPaint\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowTextW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextLengthW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapWindowPoints\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWindowVisible\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowDC\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LookupIconIdFromDirectoryEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIconFromResourceEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"KillTimer\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetTimer\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EqualRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWindowEnabled\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SendMessageA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBeep\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PtInRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetForegroundWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitWindowsEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsRectEmpty\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IntersectRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyIcon\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DispatchMessageW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TranslateMessage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekMessageW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCursorPos\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursorPos\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQuitMessage\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadImageW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSysColorBrush\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursor\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TranslateAcceleratorW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyCursor\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowRgn\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsZoomed\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OffsetRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetAsyncKeyState\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawIconEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadStringW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TrackPopupMenu\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AppendMenuW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePopupMenu\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyMenu\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetProcessDpiAwarenessContext\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemParametersInfoW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetScrollInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetScrollPos\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawEdge\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetScrollInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetScrollPos\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCapture\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UpdateWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InflateRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawFocusRect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DrawFrameControl\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDeviceCaps\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetObjectW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStockObject\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteDC\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BitBlt\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteObject\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SelectObject\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateCompatibleBitmap\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateCompatibleDC\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSolidBrush\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePatternBrush\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFontIndirectW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcessToken\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LookupPrivilegeValueW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AdjustTokenPrivileges\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegDeleteKeyW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryInfoKeyW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumKeyExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegDeleteValueW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetFileInfoW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteExW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemAlloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"StringFromGUID2\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateStreamOnHGlobal\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateInstance\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoGetClassObject\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CLSIDFromString\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OleUninitialize\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OleInitialize\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitialize\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoUninitialize\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitializeEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemRealloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PathFileExistsW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PathIsDirectoryW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PathAddBackslashW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PathAppendW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerQueryValueW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetCrackUrlW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetCloseHandle\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetSetOptionW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetOpenW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetGetLastResponseInfoW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetReadFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetQueryDataAvailable\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FtpGetFileSize\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetQueryOptionW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HttpQueryInfoW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InternetConnectW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HttpOpenRequestW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HttpSendRequestW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FtpOpenFileW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FtpCommandW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WNetAddConnection2W\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WNetGetUniversalNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MsgWaitForMultipleObjectsEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumWindows\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"wsprintfW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMenu\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ModifyMenuW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetIconInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTokenInformation\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AllocateAndInitializeSid\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EqualSid\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeSid\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSecurityDescriptorDacl\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEntriesInAclW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSecurityDescriptor\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetSecurityDescriptorDacl\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LookupAccountNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LookupAccountSidW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumValueW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseServiceHandle\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenSCManagerW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsTextUnicode\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyExA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumValueA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegDeleteKeyA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegDeleteValueA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetPathFromIDListW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetMalloc\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetSpecialFolderLocation\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateGuid\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NetLocalGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NetApiBufferFree\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConvertSecurityDescriptorToStringSecurityDescriptorW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateFreeThreadedMarshaler\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBox\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SeShutdownPrivilege\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedFlushSList\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOpenFileNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetComputerNameW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHFileOperationW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOverridePredefKey\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenServiceW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryServiceStatusEx\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"StartServiceW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LogonUserW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSidSubAuthority\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LsaClose\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryServiceObjectSecurity\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryServiceStatus\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSidSubAuthorityCount\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumServicesStatusW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSid\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConvertSidToStringSidW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LsaOpenPolicy\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LsaAddAccountRights\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ControlService\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSidIdentifierAuthority\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetServiceObjectSecurity\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSidLengthRequired\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LsaNtStatusToWinError\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetNameStringW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateContext\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTcpTable\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenMutexW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrcpyW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalAddAtomW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadProcessMemory\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrcatW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFindAtomW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcess\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateHandle\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceW\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalDeleteAtom\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageA\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NetGetDCName\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NetUserGetInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NetQueryDisplayInformation\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NetGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NetUserModalsGet\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetErrorInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysAllocString\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VariantInit\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VariantClear\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysStringLen\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysFreeString\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetKnownFolderPath\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumChildWindows\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteMenu\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStartup\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"htonl\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"gethostbyname\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ntohs\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSACleanup\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00007824.00000000.215853.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DisplayVersion\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-550","type":2,"relevance":1,"name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-225","type":2,"relevance":1,"name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"MoveFiles\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"MoveFiles\" (Indicator: \"MoveFile\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.011A9000.00000002.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","description_v2":["Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"MoveFiles\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"MoveFiles\" (Indicator: \"MoveFile\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.011A9000.00000002.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFiles\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFiles\" (Indicator: \"MoveFile\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.011A9000.00000002.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-206","type":2,"relevance":1,"name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$45","description_v2":["Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"Could not update resource for file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found reference to API \"Error creating temp file on path: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found reference to API \"Error converting file time to local time for file: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Patch file [2] is corrupt or of an invalid format. Attempting to patch file [3]. GetLastError: [4].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error getting file security: [3] GetLastError: [2]\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error determining whether file is in-use: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Could not create thread for patch application. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error deleting file: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Could not open file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Could not close file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error getting volume info. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Could not apply patch to file [2]. GetLastError: [3].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error opening file for write: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Could not get file time for file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Could not set file time for file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error getting file attributes: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error opening file for read: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Could not remove directory: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error getting file attributes. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error setting file attribute: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error setting file attributes. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error waiting for patch thread. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","Found reference to API \"Error getting disk free space. GetLastError: [2]. Volume: [3].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not update resource for file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error creating temp file on path: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp, 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error converting file time to local time for file: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Patch file [2] is corrupt or of an invalid format. Attempting to patch file [3]. GetLastError: [4].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error getting file security: [3] GetLastError: [2]\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error determining whether file is in-use: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not create thread for patch application. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error deleting file: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not open file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not close file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error getting volume info. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not apply patch to file [2]. GetLastError: [3].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error opening file for write: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not get file time for file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not set file time for file: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error getting file attributes: [3]. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error opening file for read: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Could not remove directory: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error getting file attributes. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error setting file attribute: [3] GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error setting file attributes. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error waiting for patch thread. GetLastError: [2].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Error getting disk free space. GetLastError: [2]. Volume: [3].\" (Indicator: \"GetLastError\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-209","type":2,"relevance":1,"name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServices\" (Indicator: \"StartService\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"StartServices\" (Indicator: \"StartService\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.011A9000.00000002.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")","description_v2":["Found reference to API \"StartServices\" (Indicator: \"StartService\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"StartServices\" (Indicator: \"StartService\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.011A9000.00000002.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"StartServices\" (Indicator: \"StartService\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"StartServices\" (Indicator: \"StartService\"; Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp, 00000000-00007824.00000002.219693.011A9000.00000002.mdmp, 00000000-00007824.00000002.219693.0A970000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-78","type":0,"relevance":1,"name":"Contains export functions","description":"$46","description_v2":["\"ExternalUICleaner.dll\" contains export function called \"DoRemoveExternalUIStub\" at ordinal 1","\"ExternalUICleaner.dll\" contains export function called \"RemoveExternalUIStub\" at ordinal 2","\"lzmaextractor.dll\" contains export function called \"DeleteExtractionPath\" at ordinal 1","\"lzmaextractor.dll\" contains export function called \"DeleteLZMAFiles\" at ordinal 2","\"lzmaextractor.dll\" contains export function called \"ExpandExtractionPath\" at ordinal 3","\"lzmaextractor.dll\" contains export function called \"ExtractLZMAFiles\" at ordinal 4","\"lzmaextractor.dll\" contains export function called \"FindEXE\" at ordinal 5","\"MSIFA0B.tmp\" contains export function called \"AI_AuthorSinglePackage\" at ordinal 1","\"MSIFA0B.tmp\" contains export function called \"AI_ResolveKnownFolders\" at ordinal 2","\"MSIFA0B.tmp\" contains export function called \"AI_SearchOfficeAddins\" at ordinal 3","\"MSIFA0B.tmp\" contains export function called \"AddCaspolSecurityPolicy\" at ordinal 4","\"MSIFA0B.tmp\" contains export function called \"BrowseForFile\" at ordinal 5","\"MSIFA0B.tmp\" contains export function called \"CheckFreeTCPPort\" at ordinal 6","\"MSIFA0B.tmp\" contains export function called \"CheckIfUserExists\" at ordinal 7","\"MSIFA0B.tmp\" contains export function called \"ChooseTextStyles\" at ordinal 8","\"MSIFA0B.tmp\" contains export function called \"CloseApplication\" at ordinal 9","\"MSIFA0B.tmp\" contains export function called \"CollectFeaturesWithoutCab\" at ordinal 10","\"MSIFA0B.tmp\" contains export function called \"ComputeReplaceProductsList\" at ordinal 11","\"MSIFA0B.tmp\" contains export function called \"ConfigureNonAdminServiceStart\" at ordinal 12","\"MSIFA0B.tmp\" contains export function called \"ConfigureServFailActions\" at ordinal 13","\"MSIFA0B.tmp\" contains export function called \"CopyFileFolder\" at ordinal 14","\"MSIFA0B.tmp\" contains export function called \"CreateExeProcess\" at ordinal 15","\"MSIFA0B.tmp\" contains export function called \"DeleteEmptyDirectory\" at ordinal 16","\"MSIFA0B.tmp\" contains export function called \"DeleteFromCheckList\" at ordinal 17","\"MSIFA0B.tmp\" contains export function called \"DeleteFromComboBox\" at ordinal 18"],"description_v3":[{"type":"text","value":"\"ExternalUICleaner.dll\" contains export function called \"DoRemoveExternalUIStub\" at ordinal 1"},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" contains export function called \"RemoveExternalUIStub\" at ordinal 2"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" contains export function called \"DeleteExtractionPath\" at ordinal 1"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" contains export function called \"DeleteLZMAFiles\" at ordinal 2"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" contains export function called \"ExpandExtractionPath\" at ordinal 3"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" contains export function called \"ExtractLZMAFiles\" at ordinal 4"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" contains export function called \"FindEXE\" at ordinal 5"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"AI_AuthorSinglePackage\" at ordinal 1"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"AI_ResolveKnownFolders\" at ordinal 2"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"AI_SearchOfficeAddins\" at ordinal 3"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"AddCaspolSecurityPolicy\" at ordinal 4"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"BrowseForFile\" at ordinal 5"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"CheckFreeTCPPort\" at ordinal 6"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"CheckIfUserExists\" at ordinal 7"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"ChooseTextStyles\" at ordinal 8"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"CloseApplication\" at ordinal 9"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"CollectFeaturesWithoutCab\" at ordinal 10"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"ComputeReplaceProductsList\" at ordinal 11"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"ConfigureNonAdminServiceStart\" at ordinal 12"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"ConfigureServFailActions\" at ordinal 13"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"CopyFileFolder\" at ordinal 14"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"CreateExeProcess\" at ordinal 15"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"DeleteEmptyDirectory\" at ordinal 16"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"DeleteFromCheckList\" at ordinal 17"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" contains export function called \"DeleteFromComboBox\" at ordinal 18"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-265","type":2,"relevance":1,"name":"Contains reference to Windows Startup folder","description":"$47","description_v2":["\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00007824.00000000.215853.00A60000.00000004.mdmp","00000000-00007824.00000001.217774.00A60000.00000004.mdmp","00000000-00007824.00000002.219693.00A60000.00000004.mdmp","\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00007824.00000000.215853.00A60000.00000004.mdmp","00000000-00007824.00000001.217774.00A60000.00000004.mdmp","00000000-00007824.00000002.219693.00A60000.00000004.mdmp","\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" (Indicator: \"c:\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp","00000000-00007824.00000002.219693.0A970000.00000004.mdmp","\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp","00000000-00007824.00000002.219693.0A970000.00000004.mdmp","\":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp","00000000-00007824.00000002.219693.0A970000.00000004.mdmp","\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp","00000000-00007824.00000002.219693.0A970000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"C:\\Users\\%USERNAME%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00007824.00000000.215853.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00007824.00000000.215853.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" (Indicator: \"C:\\Users\\%USERNAME%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00007824.00000001.217774.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.0A970000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1547.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-269","type":2,"relevance":1,"name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$48","description_v2":["\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: AutoTCrypto Desktop.exe","\"Software\\Caphyon\\Advanced Installer\\\" in Source: AutoTCrypto Desktop.exe","\"Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BROWSER_EMULATION\\\" in Source: AutoTCrypto Desktop.exe","\"Software\\Microsoft\\Internet Explorer\\Settings\" in Source: AutoTCrypto Desktop.exe","\"Software\\JavaSoft\\Java Development Kit\\\" in Source: AutoTCrypto Desktop.exe","\"Software\\JavaSoft\\Java Runtime Environment\\\" in Source: AutoTCrypto Desktop.exe","\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: AutoTCrypto Desktop.exe","\"SYSTEM\\CurrentControlSet\\Control\\ProductOptions\" in Source: AutoTCrypto Desktop.exe","\"Software\\Caphyon\\Setups\" in Source: AutoTCrypto Desktop.exe","\"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: AutoTCrypto Desktop.exe","\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: AutoTCrypto Desktop.exe","\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\TempPackages\" in Source: AutoTCrypto Desktop.exe","\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\[ProductName] [ProductVersion]\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp","00000000-00007824.00000002.219693.00A60000.00000004.mdmp","\"e\\Software\\Cla\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp","00000000-00007824.00000001.217774.0A970000.00000004.mdmp","00000000-00007824.00000002.219693.00A60000.00000004.mdmp","00000000-00007824.00000002.219693.0A970000.00000004.mdmp","\"Software\\Caphyon\\Advanced Installer\\[ProductCode]\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp","00000000-00007824.00000002.219693.00A60000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\PROTOCOLS\\Name-Space Handler\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp","\"Software\\[Manufacturer]\\[ProductName]\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp","00000000-00007824.00000002.219693.00A60000.00000004.mdmp","\"Software\\Caphyon\\Advanced Installer\\LZMA\\[ProductCode]\\[ProductVersion]\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp","00000000-00007824.00000002.219693.00A60000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Caphyon\\Advanced Installer\\\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BROWSER_EMULATION\\\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Internet Explorer\\Settings\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\JavaSoft\\Java Development Kit\\\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\JavaSoft\\Java Runtime Environment\\\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\ProductOptions\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Caphyon\\Setups\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\TempPackages\" in Source: AutoTCrypto Desktop.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\[ProductName] [ProductVersion]\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"e\\Software\\Cla\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000001.217774.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Caphyon\\Advanced Installer\\[ProductCode]\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\PROTOCOLS\\Name-Space Handler\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\[Manufacturer]\\[ProductName]\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Caphyon\\Advanced Installer\\LZMA\\[ProductCode]\\[ProductVersion]\" in Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.00A60000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:168:WilStaging_02\"\n \"Local\\SM0:7824:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7824:64:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:64:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:168:WilStaging_02\"","\"Local\\SM0:7824:168:WilStaging_02\"","\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\SM0:7824:64:WilError_03\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:64:WilError_03\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:7824:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:7824:64:WilError_03\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:64:WilError_03\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex\""}],"origin":"Created Mutant","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-22","type":6,"relevance":1,"name":"Fails to load modules at runtime","description":"\"AutoTCryptoDesktop.exe\" failed to load missing module \"d3d10warp.dll\" - [base:0; Status:ffffffffc000000d]","description_v2":["\"AutoTCryptoDesktop.exe\" failed to load missing module \"d3d10warp.dll\" - [base:0; Status:ffffffffc000000d]"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" failed to load missing module \"d3d10warp.dll\" - [base:0; Status:ffffffffc000000d]"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"AutoTCrypto Desktop.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"ExternalUICleaner.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n \"1033.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n \"lzmaextractor.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n \"AutoTCrypto Desktop.aiui\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"MSIFA0B.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF","description_v2":["\"AutoTCrypto Desktop.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_GUARD_CF","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","\"ExternalUICleaner.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_GUARD_CF","\"1033.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_NO_SEH","\"lzmaextractor.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_NO_SEH","IMAGE_DLLCHARACTERISTICS_GUARD_CF","\"AutoTCrypto Desktop.aiui\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_GUARD_CF","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","\"MSIFA0B.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_GUARD_CF"],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_GUARD_CF"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_GUARD_CF"},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NO_SEH"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NO_SEH"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_GUARD_CF"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_GUARD_CF"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_GUARD_CF"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-146","type":2,"relevance":1,"name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\ToServer\n Found string - \\\\.\\pipe\\ToServerAdvinst_Extract_C:\\AutoTCryptoDesktop.exe","description_v2":["Found string - \\\\.\\pipe\\ToServer","Found string - \\\\.\\pipe\\ToServerAdvinst_Extract_C:\\AutoTCryptoDesktop.exe"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\pipe\\ToServer"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\ToServerAdvinst_Extract_C:\\AutoTCryptoDesktop.exe"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"\"AutoTCryptoDesktop.exe\" loaded module \"GDI32.DLL\" at base 753b0000\n \"AutoTCryptoDesktop.exe\" loaded module \"D3D10WARP.DLL\" at base 0\n \"AutoTCryptoDesktop.exe\" loaded module \"D3D10WARP.DLL\" at base 6fb50000\n \"AutoTCryptoDesktop.exe\" loaded module \"D2D1.DLL\" at base 6f660000\n \"AutoTCryptoDesktop.exe\" loaded module \"DWRITE.DLL\" at base 6f440000","description_v2":["\"AutoTCryptoDesktop.exe\" loaded module \"GDI32.DLL\" at base 753b0000","\"AutoTCryptoDesktop.exe\" loaded module \"D3D10WARP.DLL\" at base 0","\"AutoTCryptoDesktop.exe\" loaded module \"D3D10WARP.DLL\" at base 6fb50000","\"AutoTCryptoDesktop.exe\" loaded module \"D2D1.DLL\" at base 6f660000","\"AutoTCryptoDesktop.exe\" loaded module \"DWRITE.DLL\" at base 6f440000"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"GDI32.DLL\" at base 753b0000"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"D3D10WARP.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"D3D10WARP.DLL\" at base 6fb50000"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"D2D1.DLL\" at base 6f660000"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"DWRITE.DLL\" at base 6f440000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-2","type":10,"relevance":0,"name":"Loads rich edit control libraries","description":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72F10000","description_v2":["\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72F10000"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72F10000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736B0000\n \"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 03B90000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 03290000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736B0000","description_v2":["\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736B0000","\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000","\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 03B90000","\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 03290000","\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000","\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736B0000"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736B0000"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 03B90000"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 03290000"},{"type":"linebreak"},{"type":"text","value":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000"},{"type":"linebreak"},{"type":"text","value":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736B0000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77000000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 04B40000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77000000","description_v2":["\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77000000","\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 04B40000","\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77000000"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77000000"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 04B40000"},{"type":"linebreak"},{"type":"text","value":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77000000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"$49","description_v2":["\"AutoTCrypto Desktop.exe\" was detected as \"temporary EXE SFX\" and name: \"sfx\"","\"AutoTCrypto Desktop.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"AutoTCrypto Desktop.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"AutoTCrypto Desktop.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"ExternalUICleaner.dll\" was detected as \"temporary EXE SFX\" and name: \"sfx\"","\"ExternalUICleaner.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"ExternalUICleaner.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"ExternalUICleaner.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"1033.dll\" was detected as \"temporary EXE SFX\" and name: \"sfx\"","\"1033.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"1033.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"1033.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"lzmaextractor.dll\" was detected as \"temporary EXE SFX\" and name: \"sfx\"","\"lzmaextractor.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"lzmaextractor.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"lzmaextractor.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"AutoTCrypto Desktop.aiui\" was detected as \"temporary EXE SFX\" and name: \"sfx\"","\"AutoTCrypto Desktop.aiui\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"AutoTCrypto Desktop.aiui\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"AutoTCrypto Desktop.aiui\" was detected as \"Microsoft Linker\" and name: \"Linker\"","\"MSIFA0B.tmp\" was detected as \"temporary EXE SFX\" and name: \"sfx\"","\"MSIFA0B.tmp\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"","\"MSIFA0B.tmp\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"MSIFA0B.tmp\" was detected as \"Microsoft Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" was detected as \"temporary EXE SFX\" and name: \"sfx\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" was detected as \"temporary EXE SFX\" and name: \"sfx\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" was detected as \"temporary EXE SFX\" and name: \"sfx\""},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" was detected as \"temporary EXE SFX\" and name: \"sfx\""},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" was detected as \"temporary EXE SFX\" and name: \"sfx\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" was detected as \"Microsoft Linker\" and name: \"Linker\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" was detected as \"temporary EXE SFX\" and name: \"sfx\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" was detected as \"Microsoft Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-770","type":2,"relevance":1,"name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"Found reference to API (Indicator: \"\"remove-apppackage -allusers -package '\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API (Indicator: \"remove-appxpackage \"%s\" exit $error.count\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API (Indicator: \"\"remove-apppackage -allusers -package '\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API (Indicator: \"remove-appxpackage \"%s\" exit $error.count\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"\"remove-apppackage -allusers -package '\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"remove-appxpackage \"%s\" exit $error.count\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1069.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1069/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-605","type":2,"relevance":1,"name":"May execute SQL queries","description":"$4a","description_v2":["\"INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES ('\" (Source: AutoTCrypto Desktop.exe, Indicator: \"insert into `controlevent` (`dialog_`, `control_`,`event`,`argument`, `condition`, `ordering`) values ('\")","$4b"],"description_v3":[{"type":"text","value":"\"INSERT INTO `ControlEvent` (`Dialog_`, `Control_`,`Event`,`Argument`, `Condition`, `Ordering`) VALUES ('\" (Source: AutoTCrypto Desktop.exe, Indicator: \"insert into `controlevent` (`dialog_`, `control_`,`event`,`argument`, `condition`, `ordering`) values ('\")"},{"type":"linebreak"},{"type":"text","value":"$4c"}],"origin":"File/Memory","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-187","type":2,"relevance":1,"name":"Observed Powershell command strings","description":"Found string \"powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command \"$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(1024,50);\" \"&\"\"%s\"\"\" 2> \"%s\"\" (Indicator: \"New-Object\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found string \"powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command \"$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(1024,50);\" \"&\"\"%s\"\"\" 2> \"%s\"\" (Indicator: \"New-Object\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found string \"powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command \"$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(1024,50);\" \"&\"\"%s\"\"\" 2> \"%s\"\" (Indicator: \"New-Object\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$4d","description_v2":["\"AutoTCryptoDesktop.exe\" touched \"Msi install server\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\")","\"AutoTCryptoDesktop.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\TREATAS\")","\"AutoTCryptoDesktop.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","\"AutoTCryptoDesktop.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")","\"AutoTCryptoDesktop.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","\"AutoTCryptoDesktop.exe\" touched \"MrtResourceManager Class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DBCE7E40-7345-439D-B12C-114A11819A09}\\TREATAS\")","\"AutoTCryptoDesktop.exe\" touched \"UIAutomation Registrar Class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{6E29FABF-9977-42D1-8D0E-CA7E61AD87E6}\\TREATAS\")","\"AutoTCryptoDesktop.exe\" touched \"PSOAInterface\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00020424-0000-0000-C000-000000000046}\\TREATAS\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched \"Msi install server\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched \"MrtResourceManager Class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DBCE7E40-7345-439D-B12C-114A11819A09}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched \"UIAutomation Registrar Class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{6E29FABF-9977-42D1-8D0E-CA7E61AD87E6}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched \"PSOAInterface\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00020424-0000-0000-C000-000000000046}\\TREATAS\")"}],"origin":"Registry Access","attck_id":"T1546.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-146","type":0,"relevance":0,"name":"PE file contains Debug data directory","description":"\"AutoTCrypto Desktop.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ExternalUICleaner.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"1033.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"lzmaextractor.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"AutoTCrypto Desktop.aiui\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"MSIFA0B.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","description_v2":["\"AutoTCrypto Desktop.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","\"ExternalUICleaner.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","\"1033.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","\"lzmaextractor.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","\"AutoTCrypto Desktop.aiui\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","\"MSIFA0B.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"AutoTCrypto Desktop.exe\" has an executable section named \".text\"\n \"ExternalUICleaner.dll\" has an executable section named \".text\"\n \"lzmaextractor.dll\" has an executable section named \".text\"\n \"AutoTCrypto Desktop.aiui\" has an executable section named \".text\"\n \"MSIFA0B.tmp\" has an executable section named \".text\"","description_v2":["\"AutoTCrypto Desktop.exe\" has an executable section named \".text\"","\"ExternalUICleaner.dll\" has an executable section named \".text\"","\"lzmaextractor.dll\" has an executable section named \".text\"","\"AutoTCrypto Desktop.aiui\" has an executable section named \".text\"","\"MSIFA0B.tmp\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" has an executable section named \".text\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has an executable section named \".text\""},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" has an executable section named \".text\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has an executable section named \".text\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"AutoTCrypto Desktop.exe\" has an writable section named \".data\"\n \"AutoTCrypto Desktop.exe\" has an writable section named \".didat\"\n \"ExternalUICleaner.dll\" has an writable section named \".data\"\n \"lzmaextractor.dll\" has an writable section named \".data\"\n \"AutoTCrypto Desktop.aiui\" has an writable section named \".data\"\n \"AutoTCrypto Desktop.aiui\" has an writable section named \".didat\"\n \"MSIFA0B.tmp\" has an writable section named \".data\"","description_v2":["\"AutoTCrypto Desktop.exe\" has an writable section named \".data\"","\"AutoTCrypto Desktop.exe\" has an writable section named \".didat\"","\"ExternalUICleaner.dll\" has an writable section named \".data\"","\"lzmaextractor.dll\" has an writable section named \".data\"","\"AutoTCrypto Desktop.aiui\" has an writable section named \".data\"","\"AutoTCrypto Desktop.aiui\" has an writable section named \".didat\"","\"MSIFA0B.tmp\" has an writable section named \".data\""],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.exe\" has an writable section named \".didat\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has an writable section named \".didat\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has an writable section named \".data\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"$4e","description_v2":["\"AutoTCrypto Desktop.exe\" file has an entrypoint instructions - \"call\t0x60c7db,jmp\t0x60c022,push\tebp,mov\tebp, esp,and\tdword ptr [0x750bac], 0,sub\tesp, 0x24,or\tdword ptr [0x74d020], 1,push\t0xa,call\tdword ptr [0x699268],test\teax, eax,je\t0x60c37a,and\tdword ptr [ebp - 0x10], 0,xor\teax, eax,push\tebx,push\tesi,push\tedi,xor\tecx, ecx,lea\tedi, [ebp - 0x24],push\tebx,cpuid\t,mov\tesi, ebx,pop\tebx,nop\t,mov\tdword ptr [edi], eax,mov\tdword ptr [edi + 4], esi,mov\tdword ptr [edi + 8], ecx,xor\tecx, ecx,mov\tdword ptr [edi + 0xc], edx,mov\teax, dword ptr [ebp - 0x24],mov\tedi, dword ptr [ebp - 0x20],mov\tdword ptr [ebp - 0xc], eax,xor\tedi, 0x756e6547,mov\teax, dword ptr [ebp - 0x18],\"","\"ExternalUICleaner.dll\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 0xc], 1,jne\t0x1000974e,call\t0x10009aac,push\tdword ptr [ebp + 0x10],push\tdword ptr [ebp + 0xc],push\tdword ptr [ebp + 8],call\t0x1000960a,add\tesp, 0xc,pop\tebp,ret\t0xc,mov\tecx, dword ptr [ebp - 0xc],mov\tdword ptr fs:[0], ecx,pop\tecx,pop\tedi,pop\tedi,pop\tesi,pop\tebx,mov\tesp, ebp,pop\tebp,push\tecx,ret\t,push\teax,push\tdword ptr fs:[0],lea\teax, [esp + 0xc],sub\tesp, dword ptr [esp + 0xc],push\tebx,push\tesi,push\tedi,mov\tdword ptr [eax], ebp,mov\tebp, eax,mov\teax, dword ptr [0x10044040],xor\teax, ebp,push\teax,push\tdword ptr [ebp - 4],mov\tdword ptr [ebp - 4], 0xffffffff,lea\teax, [ebp - 0xc],\"","\"1033.dll\" file has an entrypoint instructions - \"dec\tebp,pop\tedx,nop\t,add\tbyte ptr [ebx], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax + eax], al,add\tbyte ptr [eax], al,\"","\"lzmaextractor.dll\" file has an entrypoint instructions - \"mov\teax, 1,ret\t0xc,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 0x450,push\tebx,lea\teax, [esp + 4],mov\tdword ptr [esp + 4], 0x104,push\teax,lea\teax, [esp + 0x250],mov\tbl, dl,push\teax,push\t0x10002078,push\tecx,call\tdword ptr [0x10002050],test\teax, eax,jne\t0x1000112f,push\tesi,lea\teax, [esp + 0x48],mov\tedx, 0x1000209c,mov\tesi, eax,mov\tecx, 0x20,sub\tedx, esi,pop\tesi,mov\tword ptr [eax], cx,add\teax, 2,movzx\tecx, word ptr [edx + eax],test\tcx, cx,\"","\"AutoTCrypto Desktop.aiui\" file has an entrypoint instructions - \"call\t0x60c7db,jmp\t0x60c022,push\tebp,mov\tebp, esp,and\tdword ptr [0x750bac], 0,sub\tesp, 0x24,or\tdword ptr [0x74d020], 1,push\t0xa,call\tdword ptr [0x699268],test\teax, eax,je\t0x60c37a,and\tdword ptr [ebp - 0x10], 0,xor\teax, eax,push\tebx,push\tesi,push\tedi,xor\tecx, ecx,lea\tedi, [ebp - 0x24],push\tebx,cpuid\t,mov\tesi, ebx,pop\tebx,nop\t,mov\tdword ptr [edi], eax,mov\tdword ptr [edi + 4], esi,mov\tdword ptr [edi + 8], ecx,xor\tecx, ecx,mov\tdword ptr [edi + 0xc], edx,mov\teax, dword ptr [ebp - 0x24],mov\tedi, dword ptr [ebp - 0x20],mov\tdword ptr [ebp - 0xc], eax,xor\tedi, 0x756e6547,mov\teax, dword ptr [ebp - 0x18],\"","\"MSIFA0B.tmp\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 0xc], 1,jne\t0x1004e1ae,call\t0x1004e4ef,push\tdword ptr [ebp + 0x10],push\tdword ptr [ebp + 0xc],push\tdword ptr [ebp + 8],call\t0x1004e06a,add\tesp, 0xc,pop\tebp,ret\t0xc,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\tecx,lea\tecx, [esp + 8],sub\tecx, eax,and\tecx, 0xf,add\teax, ecx,sbb\tecx, ecx,or\teax, ecx,pop\tecx,jmp\t0x1004e5d0,push\tecx,lea\tecx, [esp + 8],sub\tecx, eax,and\tecx, 7,add\teax, ecx,sbb\tecx, ecx,or\teax, ecx,pop\tecx,jmp\t0x1004e5d0,mov\tecx, dword ptr [ebp - 0xc],\""],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" file has an entrypoint instructions - \"call\t0x60c7db,jmp\t0x60c022,push\tebp,mov\tebp, esp,and\tdword ptr [0x750bac], 0,sub\tesp, 0x24,or\tdword ptr [0x74d020], 1,push\t0xa,call\tdword ptr [0x699268],test\teax, eax,je\t0x60c37a,and\tdword ptr [ebp - 0x10], 0,xor\teax, eax,push\tebx,push\tesi,push\tedi,xor\tecx, ecx,lea\tedi, [ebp - 0x24],push\tebx,cpuid\t,mov\tesi, ebx,pop\tebx,nop\t,mov\tdword ptr [edi], eax,mov\tdword ptr [edi + 4], esi,mov\tdword ptr [edi + 8], ecx,xor\tecx, ecx,mov\tdword ptr [edi + 0xc], edx,mov\teax, dword ptr [ebp - 0x24],mov\tedi, dword ptr [ebp - 0x20],mov\tdword ptr [ebp - 0xc], eax,xor\tedi, 0x756e6547,mov\teax, dword ptr [ebp - 0x18],\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 0xc], 1,jne\t0x1000974e,call\t0x10009aac,push\tdword ptr [ebp + 0x10],push\tdword ptr [ebp + 0xc],push\tdword ptr [ebp + 8],call\t0x1000960a,add\tesp, 0xc,pop\tebp,ret\t0xc,mov\tecx, dword ptr [ebp - 0xc],mov\tdword ptr fs:[0], ecx,pop\tecx,pop\tedi,pop\tedi,pop\tesi,pop\tebx,mov\tesp, ebp,pop\tebp,push\tecx,ret\t,push\teax,push\tdword ptr fs:[0],lea\teax, [esp + 0xc],sub\tesp, dword ptr [esp + 0xc],push\tebx,push\tesi,push\tedi,mov\tdword ptr [eax], ebp,mov\tebp, eax,mov\teax, dword ptr [0x10044040],xor\teax, ebp,push\teax,push\tdword ptr [ebp - 4],mov\tdword ptr [ebp - 4], 0xffffffff,lea\teax, [ebp - 0xc],\""},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" file has an entrypoint instructions - \"dec\tebp,pop\tedx,nop\t,add\tbyte ptr [ebx], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax + eax], al,add\tbyte ptr [eax], al,\""},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" file has an entrypoint instructions - \"mov\teax, 1,ret\t0xc,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,sub\tesp, 0x450,push\tebx,lea\teax, [esp + 4],mov\tdword ptr [esp + 4], 0x104,push\teax,lea\teax, [esp + 0x250],mov\tbl, dl,push\teax,push\t0x10002078,push\tecx,call\tdword ptr [0x10002050],test\teax, eax,jne\t0x1000112f,push\tesi,lea\teax, [esp + 0x48],mov\tedx, 0x1000209c,mov\tesi, eax,mov\tecx, 0x20,sub\tedx, esi,pop\tesi,mov\tword ptr [eax], cx,add\teax, 2,movzx\tecx, word ptr [edx + eax],test\tcx, cx,\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" file has an entrypoint instructions - \"call\t0x60c7db,jmp\t0x60c022,push\tebp,mov\tebp, esp,and\tdword ptr [0x750bac], 0,sub\tesp, 0x24,or\tdword ptr [0x74d020], 1,push\t0xa,call\tdword ptr [0x699268],test\teax, eax,je\t0x60c37a,and\tdword ptr [ebp - 0x10], 0,xor\teax, eax,push\tebx,push\tesi,push\tedi,xor\tecx, ecx,lea\tedi, [ebp - 0x24],push\tebx,cpuid\t,mov\tesi, ebx,pop\tebx,nop\t,mov\tdword ptr [edi], eax,mov\tdword ptr [edi + 4], esi,mov\tdword ptr [edi + 8], ecx,xor\tecx, ecx,mov\tdword ptr [edi + 0xc], edx,mov\teax, dword ptr [ebp - 0x24],mov\tedi, dword ptr [ebp - 0x20],mov\tdword ptr [ebp - 0xc], eax,xor\tedi, 0x756e6547,mov\teax, dword ptr [ebp - 0x18],\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 0xc], 1,jne\t0x1004e1ae,call\t0x1004e4ef,push\tdword ptr [ebp + 0x10],push\tdword ptr [ebp + 0xc],push\tdword ptr [ebp + 8],call\t0x1004e06a,add\tesp, 0xc,pop\tebp,ret\t0xc,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\tecx,lea\tecx, [esp + 8],sub\tecx, eax,and\tecx, 0xf,add\teax, ecx,sbb\tecx, ecx,or\teax, ecx,pop\tecx,jmp\t0x1004e5d0,push\tecx,lea\tecx, [esp + 8],sub\tecx, eax,and\tecx, 7,add\teax, ecx,sbb\tecx, ecx,or\teax, ecx,pop\tecx,jmp\t0x1004e5d0,mov\tecx, dword ptr [ebp - 0xc],\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-125","type":0,"relevance":3,"name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x297400\" greater than 0x100000","description_v2":["Raw size of \".text\" is \"0x297400\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Raw size of \".text\" is \"0x297400\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-124","type":0,"relevance":3,"name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x29729a\" greater than 0x100000","description_v2":["Virtual size of \".text\" is \"0x29729a\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Virtual size of \".text\" is \"0x29729a\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00000000-00008788) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP\"\n Process \"msiexec.exe\" (UID: 00000000-00008788) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\"\n Process \"MsiExec.exe\" (UID: 00000000-00007940) was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-8LD9T6N\", LOGONSERVER=\"\\\\DESKTOP-8LD9T6N\", OneDrive=\"%USERPROFILE%\\OneDrive\", USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\", HOMEPATH=\"\\Users\\Q3fMJDE\", HOMEDRIVE=\"C:\"\"\n Process \"MsiExec.exe\" (UID: 00000000-00007940) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS\"","description_v2":["Process \"msiexec.exe\" (UID: 00000000-00008788) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP\"","Process \"msiexec.exe\" (UID: 00000000-00008788) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\"","Process \"MsiExec.exe\" (UID: 00000000-00007940) was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-8LD9T6N\", LOGONSERVER=\"\\\\DESKTOP-8LD9T6N\", OneDrive=\"%USERPROFILE%\\OneDrive\", USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\", HOMEPATH=\"\\Users\\Q3fMJDE\", HOMEDRIVE=\"C:\"\"","Process \"MsiExec.exe\" (UID: 00000000-00007940) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS\""],"description_v3":[{"type":"text","value":"Process \"msiexec.exe\""},{"type":"process","process_uid":"00000000-00008788","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP\""},{"type":"linebreak"},{"type":"text","value":"Process \"msiexec.exe\""},{"type":"process","process_uid":"00000000-00008788","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\""},{"type":"linebreak"},{"type":"text","value":"Process \"MsiExec.exe\""},{"type":"process","process_uid":"00000000-00007940","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-8LD9T6N\", LOGONSERVER=\"\\\\DESKTOP-8LD9T6N\", OneDrive=\"%USERPROFILE%\\OneDrive\", USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\", HOMEPATH=\"\\Users\\Q3fMJDE\", HOMEDRIVE=\"C:\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"MsiExec.exe\""},{"type":"process","process_uid":"00000000-00007940","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS\""}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-20","type":3,"relevance":5,"name":"Reads Windows Trust Settings","description":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"$4f","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \".\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"..\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"0409\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ADVANCEDINSTALLERS\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"APPLOCKER\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"BESTPRACTICES\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"BTHPROPS\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"CATROOT\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"COM\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"CONFIG\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"CONFIGURATION\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DIAGSVCS\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DISM\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DOWNLEVEL\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DRIVERS\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DRIVERSTORE\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"F12\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"FXSTMP\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"GROUPPOLICY\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"GROUPPOLICYUSERS\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ICSXML\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"IME\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"INETSRV\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"INPUTMETHOD\")","\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"INSTALLSHIELD\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \".\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"..\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"0409\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ADVANCEDINSTALLERS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"APPLOCKER\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"BESTPRACTICES\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"BTHPROPS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"CATROOT\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"COM\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"CONFIG\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"CONFIGURATION\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DIAGSVCS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DISM\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DOWNLEVEL\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DRIVERS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"DRIVERSTORE\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"F12\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"FXSTMP\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"GROUPPOLICY\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"GROUPPOLICYUSERS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"ICSXML\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"IME\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"INETSRV\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"INPUTMETHOD\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"INSTALLSHIELD\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows file paths for DLLs (possible dropped files)","description":"$50","description_v2":["Observed system executable string:\"%WINDIR%\\system32\\psapi.dll\" [Source: 00000000-00007824-00000C2A-2363506846]","Observed system executable string:\"%WINDIR%\\system32\\WindowsCodecs.dll\" [Source: 00000000-00007824-00000C2A-2363535215]","Observed system executable string:\"%WINDIR%\\system32\\bcrypt.dll\" [Source: 00000000-00007824-00000C2A-2363564091]","Observed system executable string:\"%WINDIR%\\system32\\msi.dll\" [Source: 00000000-00007824-00000C2A-2363661023]","Observed system executable string:\"%WINDIR%\\system32\\USP10.dll\" [Source: 00000000-00007824-00000C2A-2363758340]","Observed system executable string:\"%WINDIR%\\system32\\msls31.dll\" [Source: 00000000-00007824-00000C2A-2363791505]","Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007824-00000C2A-2363821942]","Observed system executable string:\"%WINDIR%\\system32\\mpr.dll\" [Source: 00000000-00007824-00000C2A-2363875124]","Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00007824-00000C2A-2363975385]","Observed system executable string:\"%WINDIR%\\system32\\profapi.dll\" [Source: 00000000-00007824-00000C2A-2364006893]","Observed system executable string:\"%WINDIR%\\system32\\gdiplus.dll\" [Source: 00000000-00007824-00000C2A-2364038033]","Observed system executable string:\"%WINDIR%\\system32\\userenv.dll\" [Source: 00000000-00007824-00000C2A-2364069162]","Observed system executable string:\"%WINDIR%\\system32\\dwmapi.dll\" [Source: 00000000-00007824-00000C2A-2364100609]","Observed system executable string:\"%WINDIR%\\system32\\davhlpr.dll\" [Source: 00000000-00007824-00000C2A-2364130467]","Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00007824-00000C2A-2364162793]","Observed system executable string:\"%WINDIR%\\system32\\oleaut32.dll\" [Source: 00000000-00007824-00000C2A-2364192759]","Observed system executable string:\"%WINDIR%\\system32\\comctl32.dll\" [Source: 00000000-00007824-00000C2A-2364259143]","Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00007824-00000C2A-2364289607]","Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00007824-00000C2A-2364317552]","Observed system executable string:\"%WINDIR%\\system32\\gdi32.dll\" [Source: 00000000-00007824-00000C2A-2364344960]","Observed system executable string:\"%WINDIR%\\system32\\user32.dll\" [Source: 00000000-00007824-00000C2A-2364380994]","Observed system executable string:\"%WINDIR%\\system32\\comdlg32.dll\" [Source: 00000000-00007824-00000C2A-2364433199]","Observed system executable string:\"%WINDIR%\\system32\\msimg32.dll\" [Source: 00000000-00007824-00000C2A-2364463996]","Observed system executable string:\"%WINDIR%\\system32\\dbghelp.dll\" [Source: 00000000-00007824-00000C2A-2364496734]","Observed system executable string:\"%WINDIR%\\system32\\wininet.dll\" [Source: 00000000-00007824-00000C2A-2364556481]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\psapi.dll\" [Source: 00000000-00007824-00000C2A-2363506846]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\WindowsCodecs.dll\" [Source: 00000000-00007824-00000C2A-2363535215]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\bcrypt.dll\" [Source: 00000000-00007824-00000C2A-2363564091]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\msi.dll\" [Source: 00000000-00007824-00000C2A-2363661023]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\USP10.dll\" [Source: 00000000-00007824-00000C2A-2363758340]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\msls31.dll\" [Source: 00000000-00007824-00000C2A-2363791505]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007824-00000C2A-2363821942]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\mpr.dll\" [Source: 00000000-00007824-00000C2A-2363875124]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00007824-00000C2A-2363975385]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\profapi.dll\" [Source: 00000000-00007824-00000C2A-2364006893]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\gdiplus.dll\" [Source: 00000000-00007824-00000C2A-2364038033]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\userenv.dll\" [Source: 00000000-00007824-00000C2A-2364069162]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\dwmapi.dll\" [Source: 00000000-00007824-00000C2A-2364100609]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\davhlpr.dll\" [Source: 00000000-00007824-00000C2A-2364130467]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\ole32.dll\" [Source: 00000000-00007824-00000C2A-2364162793]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\oleaut32.dll\" [Source: 00000000-00007824-00000C2A-2364192759]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\comctl32.dll\" [Source: 00000000-00007824-00000C2A-2364259143]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00007824-00000C2A-2364289607]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00007824-00000C2A-2364317552]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\gdi32.dll\" [Source: 00000000-00007824-00000C2A-2364344960]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\user32.dll\" [Source: 00000000-00007824-00000C2A-2364380994]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\comdlg32.dll\" [Source: 00000000-00007824-00000C2A-2364433199]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\msimg32.dll\" [Source: 00000000-00007824-00000C2A-2364463996]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\dbghelp.dll\" [Source: 00000000-00007824-00000C2A-2364496734]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\wininet.dll\" [Source: 00000000-00007824-00000C2A-2364556481]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00008788)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\" (UID: 00000000-00007940)","description_v2":["Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00008788)","Spawned process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\" (UID: 00000000-00007940)"],"description_v3":[{"type":"text","value":"Spawned process \"msiexec.exe\" with commandline \"/V\""},{"type":"process","process_uid":"00000000-00008788","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\""},{"type":"process","process_uid":"00000000-00007940","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00008788)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\" (UID: 00000000-00007940)","description_v2":["Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00008788)","Spawned process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\" (UID: 00000000-00007940)"],"description_v3":[{"type":"text","value":"Spawned process \"msiexec.exe\" with commandline \"/V\""},{"type":"process","process_uid":"00000000-00008788","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"MsiExec.exe\" with commandline \"-Embedding ADA04CC79F552EEE78334EF5DC769465 C\""},{"type":"process","process_uid":"00000000-00007940","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-0","type":17,"relevance":10,"name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=AutoTCrypto\" (SHA1: C3:9E:7D:05:BF:2D:F7:87:31:17:9E:DA:5F:25:19:FF:C7:F3:DC:2C; see report for more information)","description_v2":["The input sample is signed with a certificate issued by \"CN=AutoTCrypto\" (SHA1: C3:9E:7D:05:BF:2D:F7:87:31:17:9E:DA:5F:25:19:FF:C7:F3:DC:2C; see report for more information)"],"description_v3":[{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=AutoTCrypto\" (SHA1: C3:9E:7D:05:BF:2D:F7:87:31:17:9E:DA:5F:25:19:FF:C7:F3:DC:2C; see report for more information)"}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"AutoTCrypto Desktop.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ExternalUICleaner.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"1033.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"lzmaextractor.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"AutoTCrypto Desktop.aiui\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSIFA0B.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"AutoTCrypto Desktop.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE","\"ExternalUICleaner.dll\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE","\"1033.dll\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE","\"lzmaextractor.dll\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE","\"AutoTCrypto Desktop.aiui\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE","\"MSIFA0B.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-267","type":6,"relevance":1,"name":"Writes files in a temp directory","description":"\"AutoTCryptoDesktop.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\shi84C8.tmp\"\n \"AutoTCryptoDesktop.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI8536.tmp\"\n \"AutoTCryptoDesktop.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI8641.tmp\"","description_v2":["\"AutoTCryptoDesktop.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\shi84C8.tmp\"","\"AutoTCryptoDesktop.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI8536.tmp\"","\"AutoTCryptoDesktop.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI8641.tmp\""],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" writes to a file \"%TEMP%\\shi84C8.tmp\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\MSI8536.tmp\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\MSI8641.tmp\""}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-387","type":2,"relevance":1,"name":"Contains reference to software packages activity (Powershell command string)","description":"Found string \"Remove-AppxPackage \"%s\" exit $error.count\" (Indicator: \"Remove-AppxPackage\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found string \"Remove-AppxPackage \"%s\" exit $error.count\" (Indicator: \"Remove-AppxPackage\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found string \"Remove-AppxPackage \"%s\" exit $error.count\" (Indicator: \"Remove-AppxPackage\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1072","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1072","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"AutoTCryptoDesktop.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","description_v2":["\"AutoTCryptoDesktop.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"$51","description_v2":["\"AutoTCrypto Desktop.msi\" has type \"Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Code page: 1252 Title: Installation Database Subject: AutoTCrypto Desktop Author: Autotcrypto.com Keywords: Installer MSI Database Comments: autotcrypto.com Create Time/Date: Fri Aug 30 11:00:20 2024 Name of Creating Application: AutoTCrypto Desktop Security: 0 Template: ;1065 Last Saved By: ;1033 Revision Number: {E75096F1-6C4B-426F-8E87-7D68B81655E9}101.1.3;{E75096F1-6C4B-426F-8E87-7D68B81655E9}101.1.3;{0426815D-EE79-406C-8760-EDBE60E4A13F} Number of Pages: 450 Number of Characters: 63\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\AutoTCrypto Desktop.msi]- [targetUID: 00000000-00007824]","\"ExternalUICleaner.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\ExternalUICleaner.dll]- [targetUID: 00000000-00007824]","\"1033.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll]- [targetUID: 00000000-00007824]","\"lzmaextractor.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\lzmaextractor.dll]- [targetUID: 00000000-00007824]","\"AutoTCrypto Desktop.aiui\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\AutoTCrypto Desktop.aiui]- [targetUID: 00000000-00007824]","\"MSIFA0B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"background\" has type \"PC bitmap Windows 3.x format 462 x 573 x 8 cbSize 266950 bits offset 1078\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\background]- [targetUID: 00000000-00007824]","\"icon.png\" has type \"PNG image data 512 x 512 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\icon.png]- [targetUID: 00000000-00007824]","\"removico\" has type \"MS Windows icon resource - 5 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\removico]- [targetUID: 00000000-00007824]","\"custicon\" has type \"MS Windows icon resource - 5 icons 48x48 8 bits/pixel 32x32 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\custicon]- [targetUID: 00000000-00007824]","\"repairic\" has type \"MS Windows icon resource - 4 icons 48x48 8 bits/pixel 32x32 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\repairic]- [targetUID: 00000000-00007824]","\"PrepareDlgProgress.gif\" has type \"GIF image data version 89a 83 x 28\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\PrepareDlgProgress.gif]- [targetUID: 00000000-00007824]","\"installlogoicon\" has type \"MS Windows icon resource - 5 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\installlogoicon]- [targetUID: 00000000-00007824]","\"New\" has type \"MS Windows icon resource - 3 icons 48x48 32 bits/pixel 32x32 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\New]- [targetUID: 00000000-00007824]","\"insticon\" has type \"MS Windows icon resource - 3 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\insticon]- [targetUID: 00000000-00007824]","\"Up\" has type \"MS Windows icon resource - 3 icons 48x48 32 bits/pixel 32x32 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\Up]- [targetUID: 00000000-00007824]","\"optionslogoicon\" has type \"MS Windows icon resource - 3 icons 48x48 8 bits/pixel 48x48 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\optionslogoicon]- [targetUID: 00000000-00007824]","\"completi\" has type \"MS Windows icon resource - 2 icons 48x48 8 bits/pixel 48x48 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\completi]- [targetUID: 00000000-00007824]","\"waitlogoicon\" has type \"MS Windows icon resource - 2 icons 48x48 8 bits/pixel 48x48 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\waitlogoicon]- [targetUID: 00000000-00007824]","\"repair.png\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\repair.png]- [targetUID: 00000000-00007824]","\"remove.png\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\remove.png]- [targetUID: 00000000-00007824]","\"printico\" has type \"MS Windows icon resource - 2 icons 32x32 8 bits/pixel 32x32 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\printico]- [targetUID: 00000000-00007824]","\"metrorunapplicationbutton\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metrorunapplicationbutton]- [targetUID: 00000000-00007824]","\"viewreadmebutton\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\viewreadmebutton]- [targetUID: 00000000-00007824]","\"runapplicationbutton\" has type \"PNG image data 432 x 72 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\runapplicationbutton]- [targetUID: 00000000-00007824]","\"cmdlinkarrow\" has type \"MS Windows icon resource - 3 icons 16x16 16 colors 4 bits/pixel 16x16 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\cmdlinkarrow]- [targetUID: 00000000-00007824]","\"modify.png\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\modify.png]- [targetUID: 00000000-00007824]","\"info\" has type \"PNG image data 50 x 69 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\info]- [targetUID: 00000000-00007824]","\"nextcancelbuttons.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\nextcancelbuttons.xaml]- [targetUID: 00000000-00007824]","\"ProgressImage.png\" has type \"PNG image data 121 x 14 8-bit/color RGB non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\ProgressImage.png]- [targetUID: 00000000-00007824]","\"metroinstallbutton.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metroinstallbutton.xaml]- [targetUID: 00000000-00007824]","\"exclamic\" has type \"PNG image data 50 x 69 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\exclamic]- [targetUID: 00000000-00007824]","\"whitebackground\" has type \"JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 400x300 components 3\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\whitebackground]- [targetUID: 00000000-00007824]","\"print.png.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\print.png.xaml]- [targetUID: 00000000-00007824]","\"repair.png.xaml\" has type \"ASCII text with very long lines (584) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\repair.png.xaml]- [targetUID: 00000000-00007824]","\"modify.png.xaml\" has type \"ASCII text with very long lines (383) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\modify.png.xaml]- [targetUID: 00000000-00007824]","\"metroinstallbutton\" has type \"PNG image data 1020 x 54 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metroinstallbutton]- [targetUID: 00000000-00007824]","\"remove.png.xaml\" has type \"ASCII text with very long lines (379) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\remove.png.xaml]- [targetUID: 00000000-00007824]","\"metrorunapplicationbutton.xaml\" has type \"ASCII text with very long lines (373) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metrorunapplicationbutton.xaml]- [targetUID: 00000000-00007824]","\"metrobuttonimage\" has type \"PNG image data 624 x 37 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metrobuttonimage]- [targetUID: 00000000-00007824]","\"backbutton\" has type \"PNG image data 624 x 37 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\backbutton]- [targetUID: 00000000-00007824]","\"nextcancelbuttons\" has type \"PNG image data 624 x 37 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\nextcancelbuttons]- [targetUID: 00000000-00007824]","\"viewreadmebutton.xaml\" has type \"ASCII text with very long lines (387) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\viewreadmebutton.xaml]- [targetUID: 00000000-00007824]","\"sys_close_inactive.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_inactive.png]- [targetUID: 00000000-00007824]","\"sys_close_hot.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_hot.png]- [targetUID: 00000000-00007824]","\"sys_close_down.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_down.png]- [targetUID: 00000000-00007824]","\"checkbox_for_ctrls\" has type \"PNG image data 192 x 16 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\checkbox_for_ctrls]- [targetUID: 00000000-00007824]","\"sys_close_normal.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_normal.png]- [targetUID: 00000000-00007824]","\"sys_min_hot.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_min_hot.png]- [targetUID: 00000000-00007824]","\"sys_min_down.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_min_down.png]- [targetUID: 00000000-00007824]","\"sys_min_normal.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_min_normal.png]- [targetUID: 00000000-00007824]","\"sys_min_inactive.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_min_inactive.png]- [targetUID: 00000000-00007824]","\"print.png\" has type \"PNG image data 222 x 37 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\print.png]- [targetUID: 00000000-00007824]","\"checkbox\" has type \"PNG image data 192 x 16 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\checkbox]- [targetUID: 00000000-00007824]","\"browsebutton\" has type \"PNG image data 168 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\browsebutton]- [targetUID: 00000000-00007824]","\"checkbox_for_list_ctrls\" has type \"PNG image data 32 x 16 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\checkbox_for_list_ctrls]- [targetUID: 00000000-00007824]","\"frame_caption.bmp\" has type \"PC bitmap Windows 3.x format 1 x 38 x 24 image size 154 resolution 3779 x 3779 px/m cbSize 208 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_caption.bmp]- [targetUID: 00000000-00007824]","\"frame_caption_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 38 x 24 image size 154 resolution 3779 x 3779 px/m cbSize 208 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_caption_inactive.bmp]- [targetUID: 00000000-00007824]","\"frame_top_right_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_right_inactive.bmp]- [targetUID: 00000000-00007824]","\"frame_top_right.bmp\" has type \"PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_right.bmp]- [targetUID: 00000000-00007824]","\"frame_top_left_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_left_inactive.bmp]- [targetUID: 00000000-00007824]","\"frame_top_left.bmp\" has type \"PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_left.bmp]- [targetUID: 00000000-00007824]","\"backgroundsurface\" has type \"PC bitmap Windows 3.x format 5 x 5 x 32 image size 100 resolution 3780 x 3780 px/m cbSize 154 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\backgroundsurface]- [targetUID: 00000000-00007824]","\"backgroundprepare\" has type \"PC bitmap Windows 3.x format 5 x 5 x 24 image size 82 resolution 2834 x 2834 px/m cbSize 136 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\backgroundprepare]- [targetUID: 00000000-00007824]","\"frame_bottom_left_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_left_inactive.bmp]- [targetUID: 00000000-00007824]","\"frame_bottom_mid_inactive.bmp\" has type \"PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_mid_inactive.bmp]- [targetUID: 00000000-00007824]","\"frame_bottom_mid.bmp\" has type \"PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_mid.bmp]- [targetUID: 00000000-00007824]","\"frame_right.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_right.bmp]- [targetUID: 00000000-00007824]","\"frame_bottom_left.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_left.bmp]- [targetUID: 00000000-00007824]","\"MSIF87D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSI8536.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8536.tmp]- [targetUID: 00000000-00007824]","\"MSIF8ED.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSIF99C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSI86A0.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI86A0.tmp]- [targetUID: 00000000-00007824]","\"MSIF89D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSI8641.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8641.tmp]- [targetUID: 00000000-00007824]","\"MSIF90D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSIF92D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSI8680.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8680.tmp]- [targetUID: 00000000-00007824]","\"MSIF95D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSIF82E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"backbutton.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\backbutton.xaml]- [targetUID: 00000000-00007824]","\"browsebutton.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\browsebutton.xaml]- [targetUID: 00000000-00007824]","\"metrobuttonimage.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metrobuttonimage.xaml]- [targetUID: 00000000-00007824]","\"frame_right_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_right_inactive.bmp]- [targetUID: 00000000-00007824]","\"frame_top_mid.bmp\" has type \"PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_mid.bmp]- [targetUID: 00000000-00007824]","\"frame_left_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_left_inactive.bmp]- [targetUID: 00000000-00007824]","\"frame_left.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_left.bmp]- [targetUID: 00000000-00007824]","\"frame_top_mid_inactive.bmp\" has type \"PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_mid_inactive.bmp]- [targetUID: 00000000-00007824]","\"frame_bottom_right.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_right.bmp]- [targetUID: 00000000-00007824]","\"frame_bottom_right_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_right_inactive.bmp]- [targetUID: 00000000-00007824]"],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.msi\" has type \"Composite Document File V2 Document Little Endian O%WINDIR%\\Version 10.0 MSI Installer Code page: 1252 Title: Installation Database Subject: AutoTCrypto Desktop Author: Autotcrypto.com Keywords: Installer MSI Database Comments: autotcrypto.com Create Time/Date: Fri Aug 30 11:00:20 2024 Name of Creating Application: AutoTCrypto Desktop Security: 0 Template: ;1065 Last Saved By: ;1033 Revision Number: {E75096F1-6C4B-426F-8E87-7D68B81655E9}101.1.3;{E75096F1-6C4B-426F-8E87-7D68B81655E9}101.1.3;{0426815D-EE79-406C-8760-EDBE60E4A13F} Number of Pages: 450 Number of Characters: 63\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\AutoTCrypto Desktop.msi]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\ExternalUICleaner.dll]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\lzmaextractor.dll]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\AutoTCrypto Desktop.aiui]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"background\" has type \"PC bitmap Windows 3.x format 462 x 573 x 8 cbSize 266950 bits offset 1078\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\background]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"icon.png\" has type \"PNG image data 512 x 512 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\icon.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"removico\" has type \"MS Windows icon resource - 5 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\removico]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"custicon\" has type \"MS Windows icon resource - 5 icons 48x48 8 bits/pixel 32x32 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\custicon]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"repairic\" has type \"MS Windows icon resource - 4 icons 48x48 8 bits/pixel 32x32 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\repairic]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"PrepareDlgProgress.gif\" has type \"GIF image data version 89a 83 x 28\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\PrepareDlgProgress.gif]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"installlogoicon\" has type \"MS Windows icon resource - 5 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\installlogoicon]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"New\" has type \"MS Windows icon resource - 3 icons 48x48 32 bits/pixel 32x32 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\New]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"insticon\" has type \"MS Windows icon resource - 3 icons 48x48 16 colors 4 bits/pixel 48x48 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\insticon]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"Up\" has type \"MS Windows icon resource - 3 icons 48x48 32 bits/pixel 32x32 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\Up]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"optionslogoicon\" has type \"MS Windows icon resource - 3 icons 48x48 8 bits/pixel 48x48 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\optionslogoicon]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"completi\" has type \"MS Windows icon resource - 2 icons 48x48 8 bits/pixel 48x48 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\completi]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"waitlogoicon\" has type \"MS Windows icon resource - 2 icons 48x48 8 bits/pixel 48x48 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\waitlogoicon]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"repair.png\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\repair.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"remove.png\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\remove.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"printico\" has type \"MS Windows icon resource - 2 icons 32x32 8 bits/pixel 32x32 32 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\printico]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"metrorunapplicationbutton\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metrorunapplicationbutton]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"viewreadmebutton\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\viewreadmebutton]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"runapplicationbutton\" has type \"PNG image data 432 x 72 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\runapplicationbutton]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"cmdlinkarrow\" has type \"MS Windows icon resource - 3 icons 16x16 16 colors 4 bits/pixel 16x16 8 bits/pixel\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\cmdlinkarrow]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"modify.png\" has type \"PNG image data 732 x 163 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\modify.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"info\" has type \"PNG image data 50 x 69 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\info]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"nextcancelbuttons.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\nextcancelbuttons.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"ProgressImage.png\" has type \"PNG image data 121 x 14 8-bit/color RGB non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\ProgressImage.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"metroinstallbutton.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metroinstallbutton.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"exclamic\" has type \"PNG image data 50 x 69 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\exclamic]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"whitebackground\" has type \"JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 400x300 components 3\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\whitebackground]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"print.png.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\print.png.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"repair.png.xaml\" has type \"ASCII text with very long lines (584) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\repair.png.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"modify.png.xaml\" has type \"ASCII text with very long lines (383) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\modify.png.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"metroinstallbutton\" has type \"PNG image data 1020 x 54 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metroinstallbutton]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"remove.png.xaml\" has type \"ASCII text with very long lines (379) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\remove.png.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"metrorunapplicationbutton.xaml\" has type \"ASCII text with very long lines (373) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metrorunapplicationbutton.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"metrobuttonimage\" has type \"PNG image data 624 x 37 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metrobuttonimage]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"backbutton\" has type \"PNG image data 624 x 37 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\backbutton]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"nextcancelbuttons\" has type \"PNG image data 624 x 37 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\nextcancelbuttons]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"viewreadmebutton.xaml\" has type \"ASCII text with very long lines (387) with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\viewreadmebutton.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"sys_close_inactive.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_inactive.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"sys_close_hot.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_hot.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"sys_close_down.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_down.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"checkbox_for_ctrls\" has type \"PNG image data 192 x 16 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\checkbox_for_ctrls]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"sys_close_normal.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_close_normal.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"sys_min_hot.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_min_hot.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"sys_min_down.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_min_down.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"sys_min_normal.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_min_normal.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"sys_min_inactive.png\" has type \"PNG image data 28 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\sys_min_inactive.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"print.png\" has type \"PNG image data 222 x 37 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\print.png]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"checkbox\" has type \"PNG image data 192 x 16 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\checkbox]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"browsebutton\" has type \"PNG image data 168 x 26 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\browsebutton]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"checkbox_for_list_ctrls\" has type \"PNG image data 32 x 16 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\checkbox_for_list_ctrls]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_caption.bmp\" has type \"PC bitmap Windows 3.x format 1 x 38 x 24 image size 154 resolution 3779 x 3779 px/m cbSize 208 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_caption.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_caption_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 38 x 24 image size 154 resolution 3779 x 3779 px/m cbSize 208 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_caption_inactive.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_top_right_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_right_inactive.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_top_right.bmp\" has type \"PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_right.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_top_left_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_left_inactive.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_top_left.bmp\" has type \"PC bitmap Windows 3.x format 1 x 25 x 24 image size 102 resolution 2834 x 2834 px/m cbSize 156 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_left.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"backgroundsurface\" has type \"PC bitmap Windows 3.x format 5 x 5 x 32 image size 100 resolution 3780 x 3780 px/m cbSize 154 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\backgroundsurface]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"backgroundprepare\" has type \"PC bitmap Windows 3.x format 5 x 5 x 24 image size 82 resolution 2834 x 2834 px/m cbSize 136 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\backgroundprepare]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_bottom_left_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_left_inactive.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_bottom_mid_inactive.bmp\" has type \"PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_mid_inactive.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_bottom_mid.bmp\" has type \"PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_mid.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_right.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_right.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_bottom_left.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_left.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF87D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSI8536.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8536.tmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF8ED.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF99C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSI86A0.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI86A0.tmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF89D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSI8641.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8641.tmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF90D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF92D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSI8680.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8680.tmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF95D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF82E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"backbutton.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\backbutton.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"browsebutton.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\browsebutton.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"metrobuttonimage.xaml\" has type \"HTML document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\metrobuttonimage.xaml]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_right_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_right_inactive.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_top_mid.bmp\" has type \"PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_mid.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_left_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_left_inactive.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_left.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_left.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_top_mid_inactive.bmp\" has type \"PC bitmap Windows 3.x format 3 x 1 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_top_mid_inactive.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_bottom_right.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_right.bmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"frame_bottom_right_inactive.bmp\" has type \"PC bitmap Windows 3.x format 1 x 3 x 24 image size 14 resolution 2834 x 2834 px/m cbSize 68 bits offset 54\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\frame_bottom_right_inactive.bmp]- [targetUID: 00000000-00007824]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-53","type":8,"relevance":1,"name":"Drops temp files","description":"$52","description_v2":["\"MSIFA0B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"","\"MSIF87D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"","\"MSI8536.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\MSI8536.tmp]","\"MSIF8ED.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"","\"MSIF99C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"","\"MSI86A0.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\MSI86A0.tmp]","\"MSIF89D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"","\"MSI8641.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\MSI8641.tmp]","\"MSIF90D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"","\"MSIF92D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"","\"MSI8680.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\MSI8680.tmp]","\"MSIF95D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"","\"MSIF82E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""],"description_v3":[{"type":"text","value":"\"MSIFA0B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""},{"type":"linebreak"},{"type":"text","value":"\"MSIF87D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""},{"type":"linebreak"},{"type":"text","value":"\"MSI8536.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\MSI8536.tmp]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF8ED.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""},{"type":"linebreak"},{"type":"text","value":"\"MSIF99C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""},{"type":"linebreak"},{"type":"text","value":"\"MSI86A0.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\MSI86A0.tmp]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF89D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""},{"type":"linebreak"},{"type":"text","value":"\"MSI8641.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\MSI8641.tmp]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF90D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""},{"type":"linebreak"},{"type":"text","value":"\"MSIF92D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""},{"type":"linebreak"},{"type":"text","value":"\"MSI8680.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\" - Location: [%TEMP%\\MSI8680.tmp]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF95D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""},{"type":"linebreak"},{"type":"text","value":"\"MSIF82E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\""}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$53","description_v2":["\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\DIRECTX\\USERGPUPREFERENCES\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78\\PROPERTIES\\{83DA6326-97A6-4088-9453-A1923F573B29}\\0009\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DRIVERS\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DX6TEXTUREENUMINCLUSIONLIST\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\\SCHEDULER\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\AVALON.GRAPHICS\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\AVALON.GRAPHICS\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\VIDEO\\{C3FD0417-2B3B-11EE-88A6-806E6F6E6963}\\0000\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\AVALON.GRAPHICS\\DISPLAY1\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\DIRECTX\\USERGPUPREFERENCES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78\\PROPERTIES\\{83DA6326-97A6-4088-9453-A1923F573B29}\\0009\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DRIVERS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DX6TEXTUREENUMINCLUSIONLIST\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\GRAPHICSDRIVERS\\SCHEDULER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\AVALON.GRAPHICS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\AVALON.GRAPHICS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\VIDEO\\{C3FD0417-2B3B-11EE-88A6-806E6F6E6963}\\0000\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\AVALON.GRAPHICS\\DISPLAY1\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"AutoTCryptoDesktop.exe\" queries basic process information of the \"C:\\AutoTCryptoDesktop.exe\" (UID: 7824)","description_v2":["\"AutoTCryptoDesktop.exe\" queries basic process information of the \"C:\\AutoTCryptoDesktop.exe\" (UID: 7824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" queries basic process information of the \"C:\\AutoTCryptoDesktop.exe\" (UID: 7824)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$54","description_v2":["\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78\\PROPERTIES\\{83DA6326-97A6-4088-9453-A1923F573B29}\\0009\"; Key: \"\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"2F50C5D0-E25E-4F89-AB4A-31C63B518D7A\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DRIVERS\"; Key: \"SIZE\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DRIVERS\"; Key: \"NAME\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DX6TEXTUREENUMINCLUSIONLIST\"; Key: \"SIZE\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DX6TEXTUREENUMINCLUSIONLIST\"; Key: \"NAME\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"\\DEVICE\\VIDEO0\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\"; Value: \"\")","\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78\"; Key: \"HARDWAREID\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78\\PROPERTIES\\{83DA6326-97A6-4088-9453-A1923F573B29}\\0009\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"2F50C5D0-E25E-4F89-AB4A-31C63B518D7A\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DRIVERS\"; Key: \"SIZE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DRIVERS\"; Key: \"NAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DX6TEXTUREENUMINCLUSIONLIST\"; Key: \"SIZE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\DIRECT3D\\DX6TEXTUREENUMINCLUSIONLIST\"; Key: \"NAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\HARDWARE\\DEVICEMAP\\VIDEO\"; Key: \"\\DEVICE\\VIDEO0\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\ENUM\\PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78\"; Key: \"HARDWAREID\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"AutoTCryptoDesktop.exe\" reads file \"c:\\autotcryptodesktop.exe\"\n \"AutoTCryptoDesktop.exe\" reads file \"c:\\users\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"","description_v2":["\"AutoTCryptoDesktop.exe\" reads file \"c:\\autotcryptodesktop.exe\"","\"AutoTCryptoDesktop.exe\" reads file \"c:\\users\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"c:\\autotcryptodesktop.exe\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"c:\\users\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"%USERPROFILE%\\desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%USERNAME%\\documents\\desktop.ini\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity","Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","Matched sigs: Able to identify virtual environment by using user activity (API string)","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using user activity (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"AutoTCryptoDesktop.exe\" trying to touch file \"\\Global??\\FltMgrMsg\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"MountPointManager\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"\\Device\\DeviceApi\\CMApi\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"Z:\\\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\"\n \"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll\"","description_v2":["\"AutoTCryptoDesktop.exe\" trying to touch file \"\\Global??\\FltMgrMsg\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"MountPointManager\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"\\Device\\DeviceApi\\CMApi\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"Z:\\\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\"","\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll\""],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"\\Global??\\FltMgrMsg\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"MountPointManager\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"\\Device\\DeviceApi\\CMApi\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"%SAMPLEDIR%\\\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%OSUSER%\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%USERNAME%\\AppData\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to touch file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"\"AutoTCryptoDesktop.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"AutoTCryptoDesktop.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Templates\"\n \"AutoTCryptoDesktop.exe\" touched file \"C:\\Windows\\Fonts\"\n \"AutoTCryptoDesktop.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"AutoTCryptoDesktop.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates\"","description_v2":["\"AutoTCryptoDesktop.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"AutoTCryptoDesktop.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Templates\"","\"AutoTCryptoDesktop.exe\" touched file \"C:\\Windows\\Fonts\"","\"AutoTCryptoDesktop.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","\"AutoTCryptoDesktop.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates\""],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched file \"C:\\Windows\\Fonts\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"\"AutoTCryptoDesktop.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\MsiMsg.dll.mui\"\n \"AutoTCryptoDesktop.exe\" trying to access non-existent file \"C:\\AutoTCryptoDesktop.exe.Local\\\"\n \"AutoTCryptoDesktop.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\"","description_v2":["\"AutoTCryptoDesktop.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\MsiMsg.dll.mui\"","\"AutoTCryptoDesktop.exe\" trying to access non-existent file \"C:\\AutoTCryptoDesktop.exe.Local\\\"","\"AutoTCryptoDesktop.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\""],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\en-US\\MsiMsg.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to access non-existent file \"C:\\AutoTCryptoDesktop.exe.Local\\\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" trying to access non-existent file \"%TEMP%\\AI_EXTUI_BIN_7824\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-242","type":6,"relevance":1,"name":"Writes files","description":"\"AutoTCryptoDesktop.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\autotcrypto.com\\autotcrypto desktop 101.1.3\\install\\1033.dll\"\n \"AutoTCryptoDesktop.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\autotcrypto.com\\autotcrypto desktop 101.1.3\\install\\autotcrypto desktop.aiui\"","description_v2":["\"AutoTCryptoDesktop.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\autotcrypto.com\\autotcrypto desktop 101.1.3\\install\\1033.dll\"","\"AutoTCryptoDesktop.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\autotcrypto.com\\autotcrypto desktop 101.1.3\\install\\autotcrypto desktop.aiui\""],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" writes file \"%APPDATA%\\autotcrypto.com\\autotcrypto desktop 101.1.3\\install\\1033.dll\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\roaming\\autotcrypto.com\\autotcrypto desktop 101.1.3\\install\\autotcrypto desktop.aiui\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-228","type":2,"relevance":1,"name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"HttpSendRequestW\" (Indicator: \"HttpSendRequest\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-538","type":2,"relevance":1,"name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-537","type":2,"relevance":1,"name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-210","type":2,"relevance":1,"name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-241","type":2,"relevance":1,"name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-257","type":2,"relevance":1,"name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1049","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1049","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-113","type":2,"relevance":1,"name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1135","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1135","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-112","type":2,"relevance":1,"name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetLocalGroupGetInfo\" (Indicator: \"NetLocalGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"NetGetDCName\" (Indicator: \"NetGetDCName\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"NetQueryDisplayInformation\" (Indicator: \"NetQueryDisplayInformation\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"NetGroupGetInfo\" (Indicator: \"NetGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")\n Found reference to API \"NetUserModalsGet\" (Indicator: \"NetUserModalsGet\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"NetLocalGroupGetInfo\" (Indicator: \"NetLocalGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"NetGetDCName\" (Indicator: \"NetGetDCName\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"NetQueryDisplayInformation\" (Indicator: \"NetQueryDisplayInformation\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"NetGroupGetInfo\" (Indicator: \"NetGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")","Found reference to API \"NetUserModalsGet\" (Indicator: \"NetUserModalsGet\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NetLocalGroupGetInfo\" (Indicator: \"NetLocalGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetGetDCName\" (Indicator: \"NetGetDCName\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetQueryDisplayInformation\" (Indicator: \"NetQueryDisplayInformation\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetGroupGetInfo\" (Indicator: \"NetGroupGetInfo\"; File: \"AutoTCrypto Desktop.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NetUserModalsGet\" (Indicator: \"NetUserModalsGet\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1087.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1087/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-314","type":2,"relevance":1,"name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-453","type":2,"relevance":1,"name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-539","type":2,"relevance":1,"name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"AutoTCrypto Desktop.exe\")","description_v2":["Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"AutoTCrypto Desktop.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"AutoTCrypto Desktop.exe\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-169","type":2,"relevance":1,"name":"Found mail related domain names","description":"Observed email domain:\"fq%umx.0y0\" [Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp\n 00000000-00007824.00000001.217774.0A970000.00000004.mdmp\n 00000000-00007824.00000002.219693.00A60000.00000004.mdmp\n 00000000-00007824.00000002.219693.0A970000.00000004.mdmp]","description_v2":["Observed email domain:\"fq%umx.0y0\" [Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp","00000000-00007824.00000001.217774.0A970000.00000004.mdmp","00000000-00007824.00000002.219693.00A60000.00000004.mdmp","00000000-00007824.00000002.219693.0A970000.00000004.mdmp]"],"description_v3":[{"type":"text","value":"Observed email domain:\"fq%umx.0y0\" [Source: 00000000-00007824.00000001.217774.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000001.217774.0A970000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.00A60000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00007824.00000002.219693.0A970000.00000004.mdmp]"}],"origin":"File/Memory","attck_id":"T1071.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n \"2.5.29.15\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.4.3\"\n \"2.5.29.31\"\n \"2.5.29.1\"\n \"2.5.29.19\"\n \"2.5.29.17\"\n \"2.5.29.10\"","description_v2":["\"0.0.0.0\"","\"2.5.29.37\"","\"2.5.29.35\"","\"192.168.0.2\"","\"2.5.29.15\"","\"2.5.29.14\"","Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"","Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"","\"2.5.29.32\"","\"2.5.4.3\"","\"2.5.29.31\"","\"2.5.29.1\"","\"2.5.29.19\"","\"2.5.29.17\"","\"2.5.29.10\""],"description_v3":[{"type":"text","value":"\"0.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.35\""},{"type":"linebreak"},{"type":"text","value":"\"192.168.0.2\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.15\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.14\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.32\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.3\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.31\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.1\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.19\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.17\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.10\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$55","description_v2":["Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml/presentation\"","Pattern match: \"oft.com/expression/blend/2008\"","Pattern match: \"http://schemas.microsoft.com/winfx/2\"","Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml\"","Heuristic match: \"lue=false /> mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmax\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0ng$8zq,hb\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htm'x\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")","Found URL \"http://www.w3.org/1999/02/22-rdf-syntax-ns\" - Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp\")","Found URL \"https://fs.microsoft.com/fs/windows/config.json07/17\" - Source: \"00000000-00007824.00000001.217774.0A160000.00000002.mdmp\")","Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,007/17\" - Source: \"00000000-00007824.00000001.217774.0A160000.00000002.mdmp\")","Found URL \"https://autotcrypto.com/terms/aiwinuibtnmodifybackgroundnormalaiwinuibtnprintborderdisabledaiwinuibtnprintforegroundpressedaiwinuibtnborderopacitydisabledaiwinuibtnrepairbackgroundnormalaiwinuibtninstallborderpressed:\\windows\\system32\\windows.ui.dllindows.ui.core.corewindow:\\windows\\system32\\inputhost.dllai_bootstrapperoriginallang:\\windows\\system32\\inputhost.dll:\\windows\\system32\\windows.ui.dllframe_top_left_inactive.bmpai_cf_framecaptioninactivemetrorunapplicationbutton:\\windows\\system32\\windows.ui.dllmetrorunapplicationbutton:\\windows\\system32\\inputhost.dll:\\windows\\system32\\inputhost.dllframe_top_mid_inactive.bmpframe_top_right_inactive.bmpframe_caption_inactive.bmpvailable\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0ng$8zq,hb\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")","Found URL \"http://www.w3.org/1999/02/22-rdf-syntax-ns\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")","Found URL \"http://omboboxcal\\tem\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"https://dlc.autotcrypto.com/clients/win32/[arch]/autotcrypto-win32-[arch]-latest.zipprimary\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"https://panel.autotcrypto.comdefault;disable;enable;hide;showaiwinuibtnmodifyforegroundnormalthe\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"https://autotcrypto.comai_bitmap_display_modeailicenseagreementlinkaiwinuibtnbordernormalframe_bottom_left.bmp\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://schemas.openxmlformats.org/markup-compatibility/2006s\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmsuuuhhsm].sharepointlogdeletingsln:\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmax\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0ng$8zq,hb\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htm'x\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")","Found URL \"http://mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmax\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0ng$8zq,hb\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htm'x\" - Source: \"00000000-00007824.00000001.217774.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/1999/02/22-rdf-syntax-ns\" - Source: \"00000000-00007824.00000001.217774.094B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://fs.microsoft.com/fs/windows/config.json07/17\" - Source: \"00000000-00007824.00000001.217774.0A160000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://fs.microsoft.com/fs/windows/config.json,config,007/17\" - Source: \"00000000-00007824.00000001.217774.0A160000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://autotcrypto.com/terms/aiwinuibtnmodifybackgroundnormalaiwinuibtnprintborderdisabledaiwinuibtnprintforegroundpressedaiwinuibtnborderopacitydisabledaiwinuibtnrepairbackgroundnormalaiwinuibtninstallborderpresse%WINDIR%\\system32\\windows.ui.dllindows.ui.core.corewindow:\\windows\\system32\\inputhost.dllai_bootstrapperoriginallang:\\windows\\system32\\inputhost.dll:\\windows\\system32\\windows.ui.dllframe_top_left_inactive.bmpai_cf_framecaptioninactivemetrorunapplicationbutton:\\windows\\system32\\windows.ui.dllmetrorunapplicationbutton:\\windows\\system32\\inputhost.dll:\\windows\\system32\\inputhost.dllframe_top_mid_inactive.bmpframe_top_right_inactive.bmpframe_caption_inactive.bmpvailable\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0ng$8zq,hb\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/1999/02/22-rdf-syntax-ns\" - Source: \"00000000-00007824.00000001.217774.0A970000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://omboboxcal\\tem\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://dlc.autotcrypto.com/clients/win32/[arch]/autotcrypto-win32-[arch]-latest.zipprimary\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://panel.autotcrypto.comdefault;disable;enable;hide;showaiwinuibtnmodifyforegroundnormalthe\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://autotcrypto.comai_bitmap_display_modeailicenseagreementlinkaiwinuibtnbordernormalframe_bottom_left.bmp\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://schemas.openxmlformats.org/markup-compatibility/2006s\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmsuuuhhsm].sharepointlogdeletingsln:\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmax\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0ng$8zq,hb\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htm'x\" - Source: \"00000000-00007824.00000002.219693.00A60000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http:// Microsoft Corporation\"\n \"ExternalUICleaner.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"1033.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"\n \"AutoTCrypto Desktop.aiui\" was detected as \"VC8 -> Microsoft Corporation\"\n \"MSIFA0B.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","description_v2":["\"AutoTCrypto Desktop.exe\" was detected as \"VC8 -> Microsoft Corporation\"","\"ExternalUICleaner.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"1033.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"","\"AutoTCrypto Desktop.aiui\" was detected as \"VC8 -> Microsoft Corporation\"","\"MSIFA0B.tmp\" was detected as \"Borland Delphi 3.0 (???)\""],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" was detected as \"Microsoft visual C++ vx.x DLL\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" was detected as \"Borland Delphi 3.0 (???)\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")"}],"origin":"Registry Access","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":1,"name":"Section contains high entropy","description":"\"AutoTCrypto Desktop.exe\" has section name .text with entropy \"6.460821366326179\"\n \"AutoTCrypto Desktop.exe\" has section name .reloc with entropy \"6.565435959161859\"\n \"ExternalUICleaner.dll\" has section name .text with entropy \"6.6039295936479725\"\n \"ExternalUICleaner.dll\" has section name .rdata with entropy \"6.617569256065548\"\n \"ExternalUICleaner.dll\" has section name .reloc with entropy \"6.604848529295104\"\n \"AutoTCrypto Desktop.aiui\" has section name .text with entropy \"6.460821366326179\"\n \"AutoTCrypto Desktop.aiui\" has section name .reloc with entropy \"6.565435959161859\"\n \"MSIFA0B.tmp\" has section name .text with entropy \"6.48843251823427\"\n \"MSIFA0B.tmp\" has section name .reloc with entropy \"6.654410678178692\"","description_v2":["\"AutoTCrypto Desktop.exe\" has section name .text with entropy \"6.460821366326179\"","\"AutoTCrypto Desktop.exe\" has section name .reloc with entropy \"6.565435959161859\"","\"ExternalUICleaner.dll\" has section name .text with entropy \"6.6039295936479725\"","\"ExternalUICleaner.dll\" has section name .rdata with entropy \"6.617569256065548\"","\"ExternalUICleaner.dll\" has section name .reloc with entropy \"6.604848529295104\"","\"AutoTCrypto Desktop.aiui\" has section name .text with entropy \"6.460821366326179\"","\"AutoTCrypto Desktop.aiui\" has section name .reloc with entropy \"6.565435959161859\"","\"MSIFA0B.tmp\" has section name .text with entropy \"6.48843251823427\"","\"MSIFA0B.tmp\" has section name .reloc with entropy \"6.654410678178692\""],"description_v3":[{"type":"text","value":"\"AutoTCrypto Desktop.exe\" has section name .text with entropy \"6.460821366326179\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.exe\" has section name .reloc with entropy \"6.565435959161859\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has section name .text with entropy \"6.6039295936479725\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has section name .rdata with entropy \"6.617569256065548\""},{"type":"linebreak"},{"type":"text","value":"\"ExternalUICleaner.dll\" has section name .reloc with entropy \"6.604848529295104\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has section name .text with entropy \"6.460821366326179\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has section name .reloc with entropy \"6.565435959161859\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has section name .text with entropy \"6.48843251823427\""},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has section name .reloc with entropy \"6.654410678178692\""}],"origin":"Static Parser","attck_id":"T1027.009","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-307","type":6,"relevance":10,"name":"Attempts to retrieve the system language code","description":"\"AutoTCryptoDesktop.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","description_v2":["\"AutoTCryptoDesktop.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}"}],"origin":"API Call","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-223","type":6,"relevance":3,"name":"Calls an API typically used to query local/system time as file time","description":"\"AutoTCryptoDesktop.exe\" called \"FileTimeToLocalFileTime\" with parameter f04ccd2391fada01 & f04ccd2391fada01 (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"FileTimeToLocalFileTime\" with parameter f04ccd2391fada01 & f04ccd2391fada01 (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"FileTimeToLocalFileTime\" with parameter f04ccd2391fada01 & f04ccd2391fada01 (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-71","type":3,"relevance":10,"name":"Queries the installation properties of user installed products","description":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\1F69057EB4C6F624E878D7868B61559E\\INSTALLPROPERTIES\")","description_v2":["\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\1F69057EB4C6F624E878D7868B61559E\\INSTALLPROPERTIES\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\1F69057EB4C6F624E878D7868B61559E\\INSTALLPROPERTIES\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files (.ini files)","description":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","description_v2":["\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"","\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"%USERPROFILE%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%USERNAME%\\Documents\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%USERNAME%\\Music\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%USERNAME%\\Pictures\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%USERNAME%\\Videos\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%USERNAME%\\Downloads\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" reads file \"C:\\Users\\%USERNAME%\\OneDrive\\desktop.ini\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"binary-1","type":8,"relevance":10,"name":"Drops executable files","description":"$64","description_v2":["\"ExternalUICleaner.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\ExternalUICleaner.dll]- [targetUID: 00000000-00007824]","\"1033.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll]- [targetUID: 00000000-00007824]","\"lzmaextractor.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\lzmaextractor.dll]- [targetUID: 00000000-00007824]","\"AutoTCrypto Desktop.aiui\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\AutoTCrypto Desktop.aiui]- [targetUID: 00000000-00007824]","\"MSIFA0B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSIF87D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSI8536.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8536.tmp]- [targetUID: 00000000-00007824]","\"MSIF8ED.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSIF99C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSI86A0.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI86A0.tmp]- [targetUID: 00000000-00007824]","\"MSIF89D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSI8641.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8641.tmp]- [targetUID: 00000000-00007824]","\"MSIF90D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSIF92D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSI8680.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8680.tmp]- [targetUID: 00000000-00007824]","\"MSIF95D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]","\"MSIF82E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"],"description_v3":[{"type":"text","value":"\"ExternalUICleaner.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\ExternalUICleaner.dll]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\AI_EXTUI_BIN_7824\\lzmaextractor.dll]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 6 sections\"- Location: [%APPDATA%\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\AutoTCrypto Desktop.aiui]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF87D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSI8536.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8536.tmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF8ED.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF99C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSI86A0.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI86A0.tmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF89D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSI8641.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8641.tmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF90D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF92D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSI8680.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\MSI8680.tmp]- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF95D.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"},{"type":"linebreak"},{"type":"text","value":"\"MSIF82E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections\"- [targetUID: 00000000-00007824]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistence","identifier":"api-43","type":6,"relevance":10,"name":"Writes a PE file header to disc","description":"$65","description_v2":["\"AutoTCryptoDesktop.exe\" wrote 54520 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","\"AutoTCryptoDesktop.exe\" wrote 51200 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\ExternalUICleaner.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","\"AutoTCryptoDesktop.exe\" wrote 22880 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\lzmaextractor.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ..."],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" wrote 54520 bytes starting with PE header signature to file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Autotcrypto.com\\AutoTCrypto Desktop 101.1.3\\install\\1033.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ..."},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" wrote 51200 bytes starting with PE header signature to file \"%TEMP%\\AI_EXTUI_BIN_7824\\ExternalUICleaner.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ..."},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" wrote 22880 bytes starting with PE header signature to file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\AI_EXTUI_BIN_7824\\lzmaextractor.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ..."}],"origin":"API Call","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"api-291","type":6,"relevance":2,"name":"Attempts to call internet-related API for network communication","description":"\"AutoTCryptoDesktop.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Pattern Matching","identifier":"yara-153","type":13,"relevance":1,"name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Base of code of PE file \"1033.dll\"\n YARA signature for invalid Base of code of PE process \"00000000-00007824\"","description_v2":["YARA signature for invalid Base of code of PE file \"1033.dll\"","YARA signature for invalid Base of code of PE process \"00000000-00007824\""],"description_v3":[{"type":"text","value":"YARA signature for invalid Base of code of PE file \"1033.dll\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for invalid Base of code of PE process \"00000000-00007824\""}],"origin":"YARA Signature","attck_id":"T1027.013","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"string-12","type":2,"relevance":10,"name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"AutoTCrypto\" (Source: screen_2.png, Indicator: \"crypto\")","description_v2":["\"AutoTCrypto\" (Source: screen_2.png, Indicator: \"crypto\")"],"description_v3":[{"type":"text","value":"\"AutoTCrypto\" (Source: screen_2.png, Indicator: \"crypto\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-105","type":6,"relevance":5,"name":"Calls an API possibly used to take screenshots","description":"\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"84010b24\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"7010a9b\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"108d0\"\n \"cx\": \"308\"\n \"cy\": \"21\"}\n \"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"7010a9b\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"107b7\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"38010932\"\n \"cx\": \"991\"\n \"cy\": \"680\"}","description_v2":["\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"84010b24\"","\"cx\": \"1\"","\"cy\": \"1\"}","\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"7010a9b\"","\"cx\": \"16\"","\"cy\": \"16\"}","\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"108d0\"","\"cx\": \"308\"","\"cy\": \"21\"}","\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"7010a9b\"","\"cx\": \"75\"","\"cy\": \"23\"}","\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"107b7\"","\"cx\": \"16\"","\"cy\": \"16\"}","\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"38010932\"","\"cx\": \"991\"","\"cy\": \"680\"}"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"84010b24\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"1\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"1\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"7010a9b\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"16\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"16\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"108d0\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"308\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"21\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"7010a9b\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"75\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"23\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"107b7\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"16\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"16\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"38010932\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"991\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"680\"}"}],"origin":"API Call","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-40","type":6,"relevance":10,"name":"Calls an API typically used for keylogging","description":"\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}\n \"AutoTCryptoDesktop.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}","\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}","\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}","\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}","\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","\"AutoTCryptoDesktop.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"1\"}"}],"origin":"API Call","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"api-110","type":6,"relevance":10,"name":"Calls an API typically used to find and list the Windows drive types","description":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter A:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter B:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter E:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter F:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter G:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter H:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter I:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter J:\\ (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter K:\\ (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter A:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter B:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter E:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter F:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter G:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter H:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter I:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter J:\\ (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter K:\\ (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter A:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter B:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter E:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter F:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter G:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter H:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter I:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter J:\\ (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" called \"GetDriveTypeW\" with parameter K:\\ (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-19","type":3,"relevance":10,"name":"Modifies Software Policy Settings","description":"$66","description_v2":["\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\")","\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\")"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\")"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"api-284","type":6,"relevance":1,"name":"Opens a handle to the specified local process","description":"\"AutoTCryptoDesktop.exe\" opens a process \"C:\\AutoTCryptoDesktop.exe\" (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" opens a process \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 00000000-00007824)\n \"AutoTCryptoDesktop.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00007824)","description_v2":["\"AutoTCryptoDesktop.exe\" opens a process \"C:\\AutoTCryptoDesktop.exe\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" opens a process \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 00000000-00007824)","\"AutoTCryptoDesktop.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00007824)"],"description_v3":[{"type":"text","value":"\"AutoTCryptoDesktop.exe\" opens a process \"C:\\AutoTCryptoDesktop.exe\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" opens a process \"%WINDIR%\\SysWOW64\\msiexec.exe\" (UID: 00000000-00007824)"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCryptoDesktop.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00007824)"}],"origin":"API Call","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-0","type":0,"relevance":10,"name":"CRC value set in PE header does not match actual value","description":"\"ExternalUICleaner.dll\" claimed CRC 302675 while the actual is CRC 11958233\n \"1033.dll\" claimed CRC 88241 while the actual is CRC 302675\n \"lzmaextractor.dll\" claimed CRC 36710 while the actual is CRC 88241\n \"AutoTCrypto Desktop.aiui\" claimed CRC 3899949 while the actual is CRC 36710\n \"MSIFA0B.tmp\" claimed CRC 768361 while the actual is CRC 3921698","description_v2":["\"ExternalUICleaner.dll\" claimed CRC 302675 while the actual is CRC 11958233","\"1033.dll\" claimed CRC 88241 while the actual is CRC 302675","\"lzmaextractor.dll\" claimed CRC 36710 while the actual is CRC 88241","\"AutoTCrypto Desktop.aiui\" claimed CRC 3899949 while the actual is CRC 36710","\"MSIFA0B.tmp\" claimed CRC 768361 while the actual is CRC 3921698"],"description_v3":[{"type":"text","value":"\"ExternalUICleaner.dll\" claimed CRC 302675 while the actual is CRC 11958233"},{"type":"linebreak"},{"type":"text","value":"\"1033.dll\" claimed CRC 88241 while the actual is CRC 302675"},{"type":"linebreak"},{"type":"text","value":"\"lzmaextractor.dll\" claimed CRC 36710 while the actual is CRC 88241"},{"type":"linebreak"},{"type":"text","value":"\"AutoTCrypto Desktop.aiui\" claimed CRC 3899949 while the actual is CRC 36710"},{"type":"linebreak"},{"type":"text","value":"\"MSIFA0B.tmp\" claimed CRC 768361 while the actual is CRC 3921698"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"$67","description_v2":["ConnectNamedPipe","GetFileSizeEx","GetSystemInfo","DeleteFileW","GetModuleHandleA","GetTempPathW","CopyFileExW","CreateProcessW","WriteFile","GetTempFileNameW","GetSystemDirectoryW","GetDriveTypeW","LoadLibraryW","LockResource","CreateFileW","FindFirstFileExW","LoadLibraryA","GetModuleFileNameW","Process32NextW","GetFileSize","GetModuleFileNameA","CopyFileW","SleepConditionVariableSRW","ExitThread","FindNextFileW","Process32FirstW","Sleep","FindFirstFileW","GetStartupInfoW","GetCommandLineW","VirtualAlloc","GetVersionExW","LoadLibraryExA","GetTickCount","GetFileAttributesW","IsDebuggerPresent","GetProcAddress","OutputDebugStringW","GetCommandLineA","TerminateProcess","FindResourceExW","FindResourceW","LoadLibraryExW","CreateDirectoryW","CreateThread","UnhandledExceptionFilter","VirtualProtect","GetModuleHandleExW","CreateToolhelp32Snapshot","GetModuleHandleW","SetSecurityDescriptorDacl","OpenProcessToken","ShellExecuteW","ShellExecuteExW","GetUserNameW","GetComputerNameW","RegOpenKeyW","StartServiceW","ChangeServiceConfig2W","RegCreateKeyExW","RegDeleteKeyW","RegCloseKey","RegDeleteValueW","LookupAccountNameW","RegEnumKeyExW","RegOpenKeyExW","ReadProcessMemory","OpenProcess","GetWindowThreadProcessId","WSAStartup"],"description_v3":[{"type":"text","value":"ConnectNamedPipe"},{"type":"linebreak"},{"type":"text","value":"GetFileSizeEx"},{"type":"linebreak"},{"type":"text","value":"GetSystemInfo"},{"type":"linebreak"},{"type":"text","value":"DeleteFileW"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleA"},{"type":"linebreak"},{"type":"text","value":"GetTempPathW"},{"type":"linebreak"},{"type":"text","value":"CopyFileExW"},{"type":"linebreak"},{"type":"text","value":"CreateProcessW"},{"type":"linebreak"},{"type":"text","value":"WriteFile"},{"type":"linebreak"},{"type":"text","value":"GetTempFileNameW"},{"type":"linebreak"},{"type":"text","value":"GetSystemDirectoryW"},{"type":"linebreak"},{"type":"text","value":"GetDriveTypeW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryW"},{"type":"linebreak"},{"type":"text","value":"LockResource"},{"type":"linebreak"},{"type":"text","value":"CreateFileW"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileExW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryA"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameW"},{"type":"linebreak"},{"type":"text","value":"Process32NextW"},{"type":"linebreak"},{"type":"text","value":"GetFileSize"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameA"},{"type":"linebreak"},{"type":"text","value":"CopyFileW"},{"type":"linebreak"},{"type":"text","value":"SleepConditionVariableSRW"},{"type":"linebreak"},{"type":"text","value":"ExitThread"},{"type":"linebreak"},{"type":"text","value":"FindNextFileW"},{"type":"linebreak"},{"type":"text","value":"Process32FirstW"},{"type":"linebreak"},{"type":"text","value":"Sleep"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileW"},{"type":"linebreak"},{"type":"text","value":"GetStartupInfoW"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineW"},{"type":"linebreak"},{"type":"text","value":"VirtualAlloc"},{"type":"linebreak"},{"type":"text","value":"GetVersionExW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExA"},{"type":"linebreak"},{"type":"text","value":"GetTickCount"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesW"},{"type":"linebreak"},{"type":"text","value":"IsDebuggerPresent"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"OutputDebugStringW"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineA"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"FindResourceExW"},{"type":"linebreak"},{"type":"text","value":"FindResourceW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW"},{"type":"linebreak"},{"type":"text","value":"CreateDirectoryW"},{"type":"linebreak"},{"type":"text","value":"CreateThread"},{"type":"linebreak"},{"type":"text","value":"UnhandledExceptionFilter"},{"type":"linebreak"},{"type":"text","value":"VirtualProtect"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleExW"},{"type":"linebreak"},{"type":"text","value":"CreateToolhelp32Snapshot"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW"},{"type":"linebreak"},{"type":"text","value":"SetSecurityDescriptorDacl"},{"type":"linebreak"},{"type":"text","value":"OpenProcessToken"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteW"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteExW"},{"type":"linebreak"},{"type":"text","value":"GetUserNameW"},{"type":"linebreak"},{"type":"text","value":"GetComputerNameW"},{"type":"linebreak"},{"type":"text","value":"RegOpenKeyW"},{"type":"linebreak"},{"type":"text","value":"StartServiceW"},{"type":"linebreak"},{"type":"text","value":"ChangeServiceConfig2W"},{"type":"linebreak"},{"type":"text","value":"RegCreateKeyExW"},{"type":"linebreak"},{"type":"text","value":"RegDeleteKeyW"},{"type":"linebreak"},{"type":"text","value":"RegCloseKey"},{"type":"linebreak"},{"type":"text","value":"RegDeleteValueW"},{"type":"linebreak"},{"type":"text","value":"LookupAccountNameW"},{"type":"linebreak"},{"type":"text","value":"RegEnumKeyExW"},{"type":"linebreak"},{"type":"text","value":"RegOpenKeyExW"},{"type":"linebreak"},{"type":"text","value":"ReadProcessMemory"},{"type":"linebreak"},{"type":"text","value":"OpenProcess"},{"type":"linebreak"},{"type":"text","value":"GetWindowThreadProcessId"},{"type":"linebreak"},{"type":"text","value":"WSAStartup"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"General","identifier":"certificate-1","type":17,"relevance":10,"name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","description_v2":["Error: A certificate chain processed","but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)"],"description_v3":[{"type":"text","value":"Error: A certificate chain processed"},{"type":"linebreak"},{"type":"text","value":"but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)"}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 11","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 22621)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"13.0.3","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Spyware","details":["Found a string that may be used as part of an injection method"]},{"name":"Fingerprint","details":["Queries the installation properties of user installed products"]},{"name":"Evasive","details":["Input file contains API references not part of its Import Address Table (IAT)"]}],"icon":"$68","visualization":"$69","classification":["58.2% (.OCX) Windows ActiveX control","28.7% (.CPL) Windows Control Panel Item (generic)","5.2% (.EXE) Win64 Executable (generic)","2.5% (.EXE) Win16 NE executable (generic)","2.2% (.EXE) Win32 Executable (generic)"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":{"countries":[],"coordinates":[]},"port_infos":[],"extracted_strings":{"all":[{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5eltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlae3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IS0gc2tpcHMgcHJlcmVxdWlzaXRlIGluc3RhbGxhdGlvbjk8aW5zdGFuY2VfcHJvZHVjdF9uYW1lPiAtIHVuaW5zdGFsbCBhbiBpbnN0YWxsZWQgaW5zdGFuY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"ITBWMGQwezA/MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IV9pc19kb3VibGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IUZeXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eXkYrKysrKysrKysrKysrKysrODg4ODg4ODg4ODg4ODglSEhISEhISEhISEhIJU9PT09PT09PT08qVlZWVlZWVlYlQi4wXFxcXFxcKlE/NWxsbGwwWUw1cnI1YVlHNXQ8fnJGfn5+fn5+fn5gQCR4YEAkYEAkTmxMMDNsTDBvUDRab1A0c1Q4M3dZPGA=","type":"Ansi","source":"File String Dumps","process":null,"filename":"waitlogoicon","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$6a","type":"Ansi","source":"File String Dumps","process":null,"filename":"lzmaextractor.dll","compromised":null,"detection_total":null,"total":null},{"value":"$6b","type":"Ansi","source":"File String Dumps","process":null,"filename":"1033.dll","compromised":null,"detection_total":null,"total":null},{"value":"$6c","type":"Ansi","source":"File String Dumps","process":null,"filename":"ExternalUICleaner.dll","compromised":null,"detection_total":null,"total":null},{"value":"$6d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$6e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$6f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$70","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiIiIiIiIiIiIiIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiMzMzMzIiIiIiIiMiIiIiIiMzMzMiIiIiIiIzMiIiIiIiMzMyIiIiIiIjMzMiIiIiIiMzIiIiIiIiMzMzMiIiIiIiMiIiIiIiIzMzMzMiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiIiIiMzMzMzMzMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiJyI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiJvIiIiIiJvd3d3IiIsLCwlJywsLCwn","type":"Ansi","source":"File String Dumps","process":null,"filename":"cmdlinkarrow","compromised":null,"detection_total":null,"total":null},{"value":"IiVzIiBUUkFOU0ZPUk1TPSIlczslcyIgQUlfSU5TVF9NQUpPUlVQR1JBREU9MSBBSV9ORVdJTlNUPTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVzIiBUUkFOU0ZPUk1TPSIlczslczslcyIgQUlfSU5TVF9NQUpPUlVQR1JBREU9MSBBSV9ORVdJTlNUPTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVzIiBUUkFOU0ZPUk1TPSIlczslczslcyIgQUlfSU5TVF9QUk9EQ09ERVM9JXMgQUlfSU5UQU5DRV9MT0NBVElPTj0iJXMiIEFJX0lOU1RfTUFKT1JVUEdSQURFPTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IkFkZC1BcHBQcm92aXNpb25lZFBhY2thZ2UgLW9ubGluZSAtcGFja2FnZXBhdGggJw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$71","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"IlJlbW92ZS1BcHBQYWNrYWdlIC1BbGxVc2VycyAtcGFja2FnZSAn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Iy0gbGF1bmNoZXMgdGhlIEVYRSBzZXR1cCB3aXRob3V0IFVJJi0gbGF1bmNoZXMgdGhlIEVYRSBzZXR1cCB3aXRoIGJhc2ljIFVJJy0gbGlzdCBsYW5ndWFnZXMgc3VwcG9ydGVkIGJ5IHRoZSBzZXR1cD88bGFuZ19pZD4gLSBsYXVuY2hlcyB0aGUgRVhFIHNldHVwIHVzaW5nIHRoZSBzcGVjaWZpZWQgbGFuZ3VhZ2UnPHVzZXJuYW1lPiAtIHVzZXJuYW1lIHVzZWQgYnkgdGhlIHByb3h5JzxwYXNzd29yZD4gLSBwYXNzd29yZCB1c2VkIGJ5IHRoZSBwcm94eT08cGF0aF90b19sb2dfZmlsZT4gLSBjcmVhdGVzIGEgbG9nIGZpbGUgYXQgdGhlIHNwZWNpZmllZCBwYXRo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Iy0gbGF1bmNoZXMgdGhlIEVYRSBzZXR1cCB3aXRob3V0IFVJJi0gbGF1bmNoZXMgdGhlIEVYRSBzZXR1cCB3aXRoIGJhc2ljIFVJJy0gbGlzdCBsYW5ndWFnZXMgc3VwcG9ydGVkIGJ5IHRoZSBzZXR1cD88bGFuZ19pZD4gLSBsYXVuY2hlcyB0aGUgRVhFIHNldHVwIHVzaW5nIHRoZSBzcGVjaWZpZWQgbGFuZ3VhZ2UnPHVzZXJuYW1lPiAtIHVzZXJuYW1lIHVzZWQgYnkgdGhlIHByb3h5JzxwYXNzd29yZD4gLSBwYXNzd29yZCB1c2VkIGJ5IHRoZSBwcm94eT08cGF0aF90b19sb2dfZmlsZT4gLSBjcmVhdGVzIGEgbG9nIGZpbGUgYXQgdGhlIHNwZWNpZmllZCBwYXRoRXJyb3I6ICVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JDxpbnN0YW5jZV9pZD4gLSBpbnN0YWxsIG5ldyBpbnN0YW5jZTc8aW5zdGFuY2VfcHJvZHVjdF9jb2RlPiAtIHVwZ3JhZGUgYW4gaW5zdGFsbGVkIGluc3RhbmNlODxpbnN0YW5jZV9wcm9kdWN0X2NvZGU+IC0gbWFpbnRhaW4gYW4gaW5zdGFsbGVkIGluc3RhbmNlSTxuZXdfaW5zdGFuY2VfbmFtZT4gLSBjaGFuZ2UgdGhlIGluc3RhbmNlIFByb2R1Y3QgTmFtZSB3aGVuIGluc3RhbGxpbmcgaXQ+LSBzZXRzIHRoZSBwYXNzd29yZCBuZWVkZWQgdG8gaW5zdGFsbCBhbiBBRVMgZW5jcnlwdGVkIHBhY2thZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JTA0ZC0lMDJkLSUwMmQgJTAyZC0lMDJkLSUwMmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JTEhbHMhICUzIWxzITolNCFsZCEgJTIhbHMh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUEgQ09NIEFQSSByZXR1cm5lZCBlcnJvcjogWzB4JTEhbFghXS4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXEF1dG90Y3J5cHRvLmNvbVxBdXRvVENyeXB0byBEZXNrdG9wIDEwMS4xLjNcaW5zdGFsbFxBdXRvVENyeXB0byBEZXNrdG9wLm1zaQ==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JWQgaHIgJWQgbWluIGF0ICVzL3NlYw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWQgbWluICVkIHNlYyBhdCAlcy9zZWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWQgc2VjIGF0ICVzL3NlYw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWQuJWQuJWQuJWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JWhzICgweCUuOHgpIGF0IGFkZHJlc3MgWzB4JS44SXhd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMgQUlfU0VUVVBFWEVQQVRIPSIlcyIgU0VUVVBFWEVESVI9IiVzIg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMgTGFuZ3VhZ2Vz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMgT3B0aW9ucyhFeHRyYWN0aW5nIHRoZSBtYWluIGFwcGxpY2F0aW9uIGZpbGVzLi4u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMgU2V0dXA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXMsICUuMnUgJXMgJS40dSAlLjJ1OiUuMnU6JS4ydSBHTVQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXNfJXNfJXNfJXNfJXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXNob2xkZXIlZC5haXBo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXEFJX0VYVFVJX0JJTl83ODI0","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXHNoaTg0QzgudG1w","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcXCo=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxmdXNpb24uZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTWljcm9zb2Z0Lk5FVFxGcmFtZXdvcmtcdjQuMC4zMDMxOVxtc2NvcmVlaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcYWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcYXBwaGVscC5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcYmNyeXB0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY2FiaW5ldC5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY29tY3RsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY29tZGxnMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY3J5cHQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY3J5cHRzcC5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcZGF2aGxwci5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcZGJnaGVscC5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcZHdtYXBpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcZ2RpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcZ2RpcGx1cy5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJca2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbHBrLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbXByLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbXNhc24xLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbXNpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbXNpaG5kLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbXNpbWczMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbXNsczMxLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbmV0YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcbmV0dXRpbHMuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcb2xlMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcb2xlYXV0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJccHJvZmFwaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJccHJvcHN5cy5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJccHNhcGkuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcUklDSEVEMjAuRExM","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJccnNhZW5oLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcc2FtY2xpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcc2VjdXIzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcc2V0dXBhcGkuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcc2hjb3JlLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcc2hlbGwzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcc2hsd2FwaS5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcc3J2Y2xpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdXJsbW9uLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdXNlcjMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdXNlcmVudi5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcVVNQMTAuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdXNwMTAuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdXh0aGVtZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcdmVyc2lvbi5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcV2luZG93c0NvZGVjcy5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcd2luaW5ldC5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcd2ludHJ1c3QuZGxs","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcd2tzY2xpLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcd3MyXzMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcQURWQVBJMzIuRExM","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcQVBQSEVMUC5ETEw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcS0VSTkVMMzIuRExM","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcTVNDT1JFRS5ETEw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcTlRETEwuRExM","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcT0xFMzIuRExM","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcUENBQ0xJLkRMTA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcUlBDUlQ0LkRMTA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcU0hFTEwzMi5ETEw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcU0hMV0FQSS5ETEw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcc3hzLkRMTA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcVFNBUFBDTVAuRExM","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcVVNFUjMyLkRMTA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcVkVSU0lPTi5ETEw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzV09XNjRcV0xEUC5ETEw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVktJW0tJWRUJUg6JU06JVM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JjAwMEAwRjBLMFgwZDBqMHEw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JjA2MFUwXDBpMHEw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JyAtc2tpcGxpY2Vuc2Ui","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JyBBTkQgYENvbnRyb2xfYD0n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"JykgVEVNUE9SQVJZ","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jy42PkdQWmRveg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KCgoKCggICAgICAgICAgICAgICAgICBI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KCkkXi4qKz9bXXxcLXt9LDo9IQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KC4qKSg/Olx7KT8oLiopXFsxXF0oLiopKD86XH0pPyguKik=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KC4qKShce1tefV0qXH0pKC4qKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KC4qKVxbLlxdKC4qKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KC4qKVx7KC4qKVxbLlxdKC4qKVx9KC4qKQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KDB4JS44eCkgYXQgYWRkcmVzcyBbMHglLjhJeF0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KVNURCBFeGNlcHRpb24gKGF0ICUyIWxzITolMyFsZCEpIC0gJTEhaHMh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"KioqIFN0YWNrIFRyYWNlICh4ODYpICoqKg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"K0Rvd25sb2FkZWQgZmlsZSBkb2VzIG5vdCBoYXZlIGV4cGVjdGVkIHNpemU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"K3wkJFNQK0QkKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LSBkaXNwbGF5cyB0aGlzIGRpYWxvZyU8cGF0aD4gLSBleHRyYWN0cyBhbGwgZmlsZXMgdG8gPHBhdGg+","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LSBkaXNwbGF5cyB0aGlzIGRpYWxvZyU8cGF0aD4gLSBleHRyYWN0cyBhbGwgZmlsZXMgdG8gPHBhdGg+Iy0gbGF1bmNoZXMgdGhlIEVYRSBzZXR1cCB3aXRob3V0IFVJJi0gbGF1bmNoZXMgdGhlIEVYRSBzZXR1cCB3aXRoIGJhc2ljIFVJJy0gbGlzdCBsYW5ndWFnZXMgc3VwcG9ydGVkIGJ5IHRoZSBzZXR1cD88bGFuZ19pZD4gLSBsYXVuY2hlcyB0aGUgRVhFIHNldHVwIHVzaW5nIHRoZSBzcGVjaWZpZWQgbGFuZ3VhZ2UnPHVzZXJuYW1lPiAtIHVzZXJuYW1lIHVzZWQgYnkgdGhlIHByb3h5JzxwYXNzd29yZD4gLSBwYXNzd29yZCB1c2VkIGJ5IHRoZSBwcm94eT08cGF0aF90b19sb2dfZmlsZT4gLSBjcmVhdGVzIGEgbG9nIGZpbGUgYXQgdGhlIHNwZWNpZmllZCBwYXRo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LS12ZXJib3NlIC0tbG9nLWZpbGU9IiVzIiAtLXJlbW92ZS1wYWNrLWZpbGUgIiVzIiAiJXMi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LUVtYmVkZGluZyBBREEwNENDNzlGNTUyRUVFNzgzMzRFRjVEQzc2OTQ2NSBD","type":"Ansi","source":"Process Commandline","process":"MsiExec.exe","filename":"MsiExec.exe","compromised":null,"detection_total":null,"total":null},{"value":"LidTZWFyY2hpbmcgZm9yIGluc3RhbGxlZCBBcHBYIHBhY2thZ2UuLi4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Li4uIi0gZG9lcyBub3QgY2hlY2sgZm9yIGEgbmV3IHZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Li4uJDxpbnN0YW5jZV9pZD4gLSBpbnN0YWxsIG5ldyBpbnN0YW5jZTc8aW5zdGFuY2VfcHJvZHVjdF9jb2RlPiAtIHVwZ3JhZGUgYW4gaW5zdGFsbGVkIGluc3RhbmNlODxpbnN0YW5jZV9wcm9kdWN0X2NvZGU+IC0gbWFpbnRhaW4gYW4gaW5zdGFsbGVkIGluc3RhbmNlSTxuZXdfaW5zdGFuY2VfbmFtZT4gLSBjaGFuZ2UgdGhlIGluc3RhbmNlIFByb2R1Y3QgTmFtZSB3aGVuIGluc3RhbGxpbmcgaXQ+LSBzZXRzIHRoZSBwYXNzd29yZCBuZWVkZWQgdG8gaW5zdGFsbCBhbiBBRVMgZW5jcnlwdGVkIHBhY2thZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVV9DcnRfbmV3X2RlbGV0ZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWN0eXBlX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfYWNjZXNzX2RlbmllZEB3aW5ydEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfY2FuY2VsZWRAd2lucnRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfY2hhbmdlZF9zdGF0ZUB3aW5ydEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfY2xhc3Nfbm90X2F2YWlsYWJsZUB3aW5ydEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfY2xhc3Nfbm90X3JlZ2lzdGVyZWRAd2lucnRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfZXJyb3JAd2lucnRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfaWxsZWdhbF9kZWxlZ2F0ZV9hc3NpZ25tZW50QHdpbnJ0QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfaWxsZWdhbF9tZXRob2RfY2FsbEB3aW5ydEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfaWxsZWdhbF9zdGF0ZV9jaGFuZ2VAd2lucnRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfaW52YWxpZF9hcmd1bWVudEB3aW5ydEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfbm9faW50ZXJmYWNlQHdpbnJ0QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfbm90X2ltcGxlbWVudGVkQHdpbnJ0QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfb3V0X29mX2JvdW5kc0B3aW5ydEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVWhyZXN1bHRfd3JvbmdfdGhyZWFkQHdpbnJ0QEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0NyZWF0ZUBFZGl0Q29udHJvbFdpblJUQEBVQUVYWFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0RvU2F2ZURhdGFAQ29tYm9Cb3hDb250cm9sV2luUlRAQFVBRV9OWFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUJvcmRlckBDb250cm9sc0BYYW1sQFVJQFdpbmRvd3NAd2lucnRAQFZXaW5SVENvbnRyb2xCYXNlQEBAQFVBRVhfTkBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUJ1dHRvbkBDb250cm9sc0BYYW1sQFVJQFdpbmRvd3NAd2lucnRAQFZXaW5SVENvbnRyb2xCYXNlQEBAQFVBRVhfTkBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUNoZWNrQm94QENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUNvbWJvQm94QENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUdyaWRAQ29udHJvbHNAWGFtbEBVSUBXaW5kb3dzQHdpbnJ0QEBWPyRSYWRpb0J1dHRvbkdyb3VwQ29yZUBWV2luUlRDb250cm9sQmFzZUBAQEBAQFVBRVhfTkBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUdyaWRAQ29udHJvbHNAWGFtbEBVSUBXaW5kb3dzQHdpbnJ0QEBWV2luUlRDb250cm9sQmFzZUBAQEBVQUVYX05AWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUltYWdlQENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUxpc3RCb3hAQ29udHJvbHNAWGFtbEBVSUBXaW5kb3dzQHdpbnJ0QEBWV2luUlRDb250cm9sQmFzZUBAQEBVQUVYX05AWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVUxpc3RWaWV3QENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVBhc3N3b3JkQm94QENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVBpdm90QENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVj8kVGFiQ29udHJvbENvcmVAVldpblJUQ29udHJvbEJhc2VAQEBAQEBVQUVYX05AWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVByb2dyZXNzQmFyQENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVJhZGlvQnV0dG9uQENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVJpY2hFZGl0Qm94QENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVNwbGl0QnV0dG9uQENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVRleHRCbG9ja0BDb250cm9sc0BYYW1sQFVJQFdpbmRvd3NAd2lucnRAQFZXaW5SVENvbnRyb2xCYXNlQEBAQFVBRVhfTkBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVRleHRCb3hAQ29udHJvbHNAWGFtbEBVSUBXaW5kb3dzQHdpbnJ0QEBWV2luUlRDb250cm9sQmFzZUBAQEBVQUVYX05AWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0VuYWJsZUNvbnRyb2xAPyRDb250cm9sV2luUlRAVVRyZWVWaWV3QENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAVldpblJUQ29udHJvbEJhc2VAQEBAVUFFWF9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0ZpbmRATXNpeEZpbmRlckBAUUFFP0FWPyRDU3RyaW5nVEBfV1Y/JFN0clRyYWl0QVRMQF9XVj8kQ2hUcmFpdHNDUlRAX1dAQVRMQEBAQVRMQEBAQVRMQEBBQlYzNEAwMEBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P0luaXRDb250cm9sQENoZWNrQm94Q29udHJvbFdpblJUQEBVQUVYWFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P09uUHJvcENoYW5nZWRAV2luUlRDb250cm9sQmFzZUBAQUFFX05BQlZFdmVudEBleHVpQEBAWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P09uUmVzZXRAV2luUlRDb250cm9sQmFzZUBAQUFFX05BQlZFdmVudEBleHVpQEBAWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P1NldEFzRGVmYXVsdEJ1dHRvbkBJbWFnZUJ1dHRvbkNvbnRyb2xXaW5SVEBARUFFX05fTkBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P1NldEFzRGVmYXVsdEJ1dHRvbkBQdXNoQnV0dG9uQ29udHJvbFdpblJUQEBFQUVfTl9OQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P1NldEZvbnREZWNvcmF0aW9uc0BVdGlsV2luUlRAQFNBWFVGcmFtZXdvcmtFbGVtZW50QFhhbWxAVUlAV2luZG93c0B3aW5ydEBAUEFVRm9udFN0eWxlQEBAWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P1NldFBvc0BQcm9ncmVzc0JhcldpblJUQEBVQUVYSUBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P1NldFJhbmdlQFByb2dyZXNzQmFyV2luUlRAQFVBRVhJSUBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P1Nob3dDb250cm9sQFdpblJUQ29udHJvbEJhc2VAQFVBRVhfTkBaQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P1VwZGF0ZUZyb21Qcm9wZXJ0eUBDb21ib0JveENvbnRyb2xXaW5SVEBAVUFFX05YWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzE/P1VwZGF0ZVdpbmRvd1RleHRAVGV4dENvbnRyb2xXaW5SVEBAVUFFWEFCVj8kYmFzaWNfc3RyaW5nQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBWPyRhbGxvY2F0b3JAX1dAMkBAc3RkQEBAWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzI/P0V2ZW50RGxnUG9wdXBNZW51QE5hdGl2ZURpYWxvZ0BAQUFFX05BQlZFdmVudEBleHVpQEBAWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzI/P09uTXNnQm94QFdpblJURGlhbG9nQEBBQUVKSUlKQUFIQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzM/P0luc2VydFRyZWVJdGVtQFF1aWNrU2VsZWN0aW9uVHJlZUNvbnRyb2xXaW5SVEBAUUFFP0FWPyRvcHRpb25hbEBVVHJlZVZpZXdOb2RlQENvbnRyb2xzQFhhbWxAVUlAV2luZG93c0B3aW5ydEBAQHN0ZEBAQUJVRmVhdHVyZUBAVjM0QDFAWkA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMT5APzY/P09uRGR4QFdpblJUQ29udHJvbEJhc2VAQEFBRV9OQUJWRXZlbnRAZXh1aUBAQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMjgwPkBEaXJlY3RVSUhvc3RHZW5lcmF0b3JAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMjgwXz5AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVjxsYW1iZGFfMj5APzg/P09uRGR4QFdpblJUQ29udHJvbEJhc2VAQEFBRV9OQUJWRXZlbnRAZXh1aUBAQFpA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kX0lvc2JASEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfZmlsZWJ1ZkBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfaW9zQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfb3N0cmVhbUBfV1U/JGNoYXJfdHJhaXRzQF9XQHN0ZEBAQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kYmFzaWNfc3RyZWFtYnVmQF9XVT8kY2hhcl90cmFpdHNAX1dAc3RkQEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29kZWN2dEBfV0RVX01ic3RhdGV0QEBAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY29sbGF0ZUBfV0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kY3R5cGVAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtX3B1dEBfV1Y/JG9zdHJlYW1idWZfaXRlcmF0b3JAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQEBzdGRAQEBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVj8kbnVtcHVuY3RAX1dAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9GYWNldF9iYXNlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9HZW5lcmljX2Vycm9yX2NhdGVnb3J5QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9Jb3N0cmVhbV9lcnJvcl9jYXRlZ29yeTJAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9Mb2NpbXBAbG9jYWxlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9TeXN0ZW1fZXJyb3JAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hcnJheV9uZXdfbGVuZ3RoQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9jYXN0QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9leGNlcHRpb25Ac3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9mdW5jdGlvbl9jYWxsQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9vcHRpb25hbF9hY2Nlc3NAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF92YXJpYW50X2FjY2Vzc0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNBdGxFeGNlcHRpb25AQVRMQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNJbkFyY2hpdmVFeGNlcHRpb25ATjd6QE5BcmNoaXZlQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNvZGVjdnRfYmFzZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNVbnN1cHBvcnRlZEZlYXR1cmVFeGNlcHRpb25ATjd6QE5BcmNoaXZlQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmVycm9yX2NhdGVnb3J5QHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkV4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZhY2V0QGxvY2FsZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZhaWx1cmVAaW9zX2Jhc2VAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmZvcm1hdF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVklFeGNlcHRpb25AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmludmFsaWRfYXJndW1lbnRAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmlvc19iYXNlQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnJlZ2V4X2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnJ1bnRpbWVfZXJyb3JAc3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNlaEV4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnN5c3RlbV9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVldpbmRvd3NFeGNlcHRpb25AQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LmBOYW1lYCA9ICd7fSc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LmFwcGluc3RhbGxlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYQ0FB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYTEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYTFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LlA2QV9OQUJWPyRiYXNpY19zdHJpbmdAX1dVPyRjaGFyX3RyYWl0c0BfV0BzdGRAQFY/JGFsbG9jYXRvckBfV0AyQEBzdGRAQEBa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHN4ZGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHZvbHRtZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHp6emRiZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$72","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"LnRleHQkbW4kMDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$73","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Flc3Bhc3N3b3Jk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2NhbGxiYWNraWQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2RlYnVnZmlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2RlbGV0ZWx6bWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2V4ZWJhc2ljdWk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2V4ZWZ1bGx1aQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2V4ZW5vdXBkYXRlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2V4dHJhY3Rsem1h","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2ZvcmNlY2xlYW51cA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2ZvcmNlcmVzdGFydA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2dyb3Vwc2V4dHJhY3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2luc3RuYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2xpc3RsYW5ncw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L25vcHJlcmVxcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L25vcmVzdGFydA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L29yaWdpbmFsUGF0aA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3Bhc3N3b3Jk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3Byb21wdHJlc3RhcnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3Byb3h5cGFzc3dvcmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3Byb3h5dXNlcm5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3VpdGhyZWFk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3VuaW5zdGFsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3VuaW5zdGFsbGluc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3VwZ3JkaW5zdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"L3VzZXJuYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCEwJTArMC8wNTBDMFEwVTBhMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCEwKDAvMDUwPjBHMGEwazBxMHIy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCEwNDBHMFowfjA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$74","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCIiJ3d3IiIiIjN2ZmZzMzIiIiJ3ciIiIiInd2ZndyIiIiInd3ciIiIiIidmZyIiIiIid3InIiIiIiInZmciIiIid3ciInciIiIiJ2ZnIiIiJ3dyIiInciIiIidmZyIiIidyIiIiInciIiInd3ciIiIiIiIiIiIiIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCIid3InciIiI0RHZmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCInIiIiIiIiODMzMzMz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCIndyIidyIiMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCIwKDA/MEQwSjBUMF8wZTBvMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCIwNjBUMHMw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCJ3ciIiInIiNERI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCJ3ciIiJyIiNERER0RF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCMxKDEyMUExVjFkMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCQwKTA8MEcwXTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCQwNjA7MEkwTjBcMGEwbzB0MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCQxKDIyMkQyTDJXMmUydTJ9Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCUwLDAxMDowPzBJMGMw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCUwLDA5MEEwWzB4MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCYwMjBLMHYw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCYxNjFWMmcy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCgwOjA/MFIwaTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCgwTDBWMF4wZTB2MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCkwLzA5MFAwVTBbMGYwbDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCowMTA6MEwwUTBiMHow","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCowOTBRMGAweDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCwwOjBMMFQwYTBoMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MCwxOzFQMV8x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MC0wQDBUMHow","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MC4wLjAuMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MC4wRTBbMHEw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MC4xVjFmMXkx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MC8xUDFYMXIx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDAwMTAyMDMwNDA1MDYwNzA4MDkxMDExMTIxMzE0MTUxNjE3MTgxOTIwMjEyMjIzMjQyNTI2MjcyODI5MzAzMTMyMzMzNDM1MzYzNzM4Mzk0MDQxNDI0MzQ0NDU0NjQ3NDg0OTUwNTE1MjUzNTQ1NTU2NTc1ODU5NjA2MTYyNjM2NDY1NjY2NzY4Njk3MDcxNzI3Mzc0NzU3Njc3Nzg3OTgwODE4MjgzODQ4NTg2ODc4ODg5OTA5MTkyOTM5NDk1OTY5Nzk4OTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$75","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEnMTkxajFzMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFhQmJDY0RkRWVGZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OWFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OWFiY2RlZmdoamttbnBxcnN0dnd4eXo=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDQwOTA/MEowUDBnMGwwcjB9MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDYwQjBQMHsw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDYxRDFoMXQx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDYxSDFtMXox","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDc2N0EwMzYtMEQyMi00OGFhLUJBNjktQjYxOTQ4MEYzOENC","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDc2N2EwMzYtMGQyMi00OGFhLWJhNjktYjYxOTQ4MGYzOGNiQG5jYWxycGM6","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MD4wTjBcMGcwdTAkMUUxXTFqMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MFwxRzJ8Micz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEYwVjB1MHww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MFgxXzFoMXox","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSExJzEyMTgxUDFZMV4xZDFvMXUx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSExKzE0MUIxRzFVMVoxaDFtMXsx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSExLDE2MUAxTTFbMWgxezE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSMxOzFKMWIxcTE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSM0azRyNHg0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSQxKjE1MTsxUjFXMV0xaDFuMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSUxQDFNMXYx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSUxSjFfMXUx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSgxOjE/MVIxaTE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSgyLzI4MkoyTzJiMnky","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSoxMDFHMUwxUjFdMWMxejE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSsxOzFOMXYx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSsxQTFUMWcxejE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSwxNjE+MUUxVjE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MSwyQzJbMnIy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MS4yTTJbMnoy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MS4zLjYuMS40LjEuMzExLjIuMS4zMA==","type":"Ansi","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MTAuMC4xNzc2My4w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTAuMC4yMjYyMS4w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTJGMlYydTJ8Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTMyWjJhMiYzNjM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTYxRTFdMXkx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTYxSDEmMjQyVTJbMm0y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTYyRjJlMmwyeTI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MTcySjJRMloybDJxMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MUYyWDImNDg0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MXA1dDV4NXw1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MiEyJjIuMjwyQTJPMlQyYjJnMnUyejI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MiEzNDM+M0YzTTNhMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MiIyNDI5MkwyVzJtMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MiIyPjJKMlgydDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MiUyMTI8MkYyUDJdMm4yezI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MiYyLjI1MkYy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MicyNzJPMmcy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MigyMzI5MkMyWjJhMmYybDJ2Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MigyZjJ3MmkzezM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MigyTjJdMmoy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MikyMTJLMmgy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MioyLzJCMlky","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Mi41LjI5LjM1","type":"Ansi","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Mi41LjI5LjM3","type":"Ansi","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Mi8yNDI6MkUySzJiMmcybTJ4Mn4y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjIyNzI9MkgyTjJlMmoycDJ7Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjMmMzAzZjN4Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjMpMzszcDM8NF00cTQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjMyUjJ1Mn4y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjMzM0czXjN0Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjQzWDNjM3oz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjYyQzJbMmsy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjYzTzNdM2czfjM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjgyRDJQMlUybjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjszbzN0M34zIDRDNGY1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Mj4zUjNZM2IzdDN5Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MkMyWDJhMncy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MmYzdjMmNDY0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MmYzdjNWNGQ0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MmY1MGM1ZDAtZTI1ZS00Zjg5LWFiNGEtMzFjNjNiNTE4ZDdh","type":"Ansi","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MkgzTzNYM2ozbzM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyAzKDM2MzszSTNOM1wzYTNvM3Qz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyAzNjM9M00zdjM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyAzODNCM28zdTM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyE0OzRGNHw0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyIzMDM1M0MzSDNZM14zZjN0M3kz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyI0LzQ9NEw0XTRrNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyQzUTNbM3EzezM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyUzLDM5M1AzZDM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyYzKzMxMzwzQjNZM14zZDNuM3kz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MyYzOTNJM08zVDNeM2MzaDNuM3MzfDM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MygzLjNHM00zVjNcM2UzeDN9Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzIzOTNCM1QzWTNsM3cz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzMzMzMzMzMzMzMzMzM/MzMzMzMzMzMzMzMzMzMzMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzMzMzMzMzMzMzMzMzM/MzMzMzMzMzMzMzMzMzMzMz0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzMzMzMzMzMzMzMzMzM/MzMzMzMzMzMzMzMzMzMzM1MzMzMzMzMzMzMzMzMzMzQzMzMzMzMzMzMzMzMzMzMz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$76","type":"Ansi","source":"File String Dumps","process":null,"filename":"installlogoicon","compromised":null,"detection_total":null,"total":null},{"value":"MzQiNEc0XjRlNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzRGNFY0dTR8NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzYzSzNmNnc2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzY0RjRlNGw0eTQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzY0RzQhNzY3RTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzczWjNzM30z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"M080JjU4NWY3eDc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCA0JTQzNDg0RjRLNFw0YTRpNHc0fDQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCA0NjRBNHY1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCE1NzVcNXI1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCI0MDQ1NEM0SDRWNFs0aTRuNHw0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCI0NDQ5NEw0VzRtNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCI0NzQ9NGY0cjQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCI0OTQ+NEQ0TzRVNGw0cTR3NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCM1LDVLNXY1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCM1SjVaNXs1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCU1XzVvNXY1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCY0MTQ3NEE0WDRdNGM0bjR0NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCY1NjVVNVw1aTVxNQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCY1NjVYNWc1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCc1OTVYNXM1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCg1LzU4NUo1TzViNXk1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCk0PjRRNHc0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NCw0OTRHNFc0XDRiNGY0azRxNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NC00RjRfNHA0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NC40NDQ6NFA0ZjRyNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NC40PjRWNG40","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NDMzMzMzMzMzMzMzMzMz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NDMzMzMzMzMzMzMzMzMzMzM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NDY1QzVYNWU1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NEc0ajQ2NUM1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NEg1TzVYNWo1bzU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NFk0ZDRvNHo0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSE1KDUxNUM1SDVZNXY1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSE1OTVWNWA1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSE2NDZHNmw2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSI2PDY3N103fTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSM1NDU6NUE1VDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSQ1KTUvNTo1QDVXNVw1YjVsNXc1fTU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSQ1LzU1NUw1UTVXNWI1aDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSY1KzUzNTo1QDVKNWE1ZjVsNXc1fTU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSY1RTVMNVk1YTV5NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSY1RTVMNVk1YTV7NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSg1PjVVNWs1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NSo1LzU9NUI1UDVVNWM1aDV2NXs1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NS01MjVANUU1VjVbNWM1cTV2NQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTs1TTVdNW41fDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NT42UjZZNmI2dDZ5Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NUY2WDZFN2A3LDhGOFU4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NUc1bDVzNSk2OzY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NUk1JjY2Nlc2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiA2NzY8NkI2TTZTNmo2bzZ1Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiE2MzZGNmw2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiI2KTYyNkQ2STZcNmc2fTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiM3LDdNN2s3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiQ2KTY3Njw2SjZPNl02YjZwNnU2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiQ3MTdIN1c3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiQ3SDdTN283","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiU2LDY5NkE2WTZ2Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiVzIG1hbmRhdG9yeSBwcmVyZXF1aXNpdGUgd2FzIG5vdCBjb3JyZWN0bHkgaW5zdGFsbGVkLidTZWFyY2hpbmcgZm9yIGluc3RhbGxlZCBBcHBYIHBhY2thZ2UuLi4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiY2NTZfNnc2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiY2PTZENm42fjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiY3NTdaN283","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiY3ODcpODs4bzg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NiY3bzcmODU4cTg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nic2LjY3Nko2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nig2LTYzNjk2STZTNl02","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nig2MjY8Nko2VDZeNmw2djY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nik2OzZONnQ2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nio2NzZVNmY2czY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nis2PTZCNkk2VjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Niw2MTY3NkI2SDZfNmQ2ajZ1Nns2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Niw2NTZQNl82fTY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ni02MjZANkU2UzZYNl42aDZ6Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ni02WDZfNmw2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ni42SDZoNmw2cDZ0Nng2fDY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjA2NjZANks2UDZjNmg2cDZ3Nn02","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjE3QjdTNzg/OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjM2OTZDNlg2XjZrNnE2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NjcmNzI3Szd2Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nlw2cDZ2Nn02","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nl43KTg5OHI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NkY3VTdtN3g3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nkw3UjdjN203","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nlg3XzdoN3o3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyA3Nzc8N0I3TTdTN2o3bzd1Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyA3QjdQN2Y3cDc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyE4NDg+OEY4TThhOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyI3LTczN0o3TzdVN2A3Zjd9Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyM3OjdPN2I3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyQ3OzdQN2M3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyQ4MTg6OEQ4VDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyY3Kzc5Nz43TDdRN183ZDdqN3Q3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyY4NThpOH44","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyY4NjhVOFw4aThxOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NyY4RTheOG84Jjk3OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nyc3LDc6Nz83TTdSN2A3ZTdzN3g3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nyc4UzhlOHY4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nyo4TjhdOG04","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Nyw3NTc7N0Y3TDdWN183cjd3N303","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ny43QzdUN2w3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NzI3OTdCN1Q3WTdsN3c3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NzY3QDcmODg4cDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NzgpODw4RzhVOGg4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NzgwOFY4Zjh5OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"NzhGOFY4dTh8OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"N0Y4WDhLOWY5MjpGOlg6Ojs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"N0Y4WDhtOCQ5cTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"N0g4TzhYOGo4bzg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"N004YTgmOXY5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"N1E4dDgoOWQ5QTpQOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"N1U3eDdWOGU4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCE4Jzg+OEM4SThUOFo4cTh2OHw4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCE4OThWOGA4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCI4KzhNOFU4XTh0OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCQ4KzhSOFk4YDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCQ4Ljg4OEI4SDhSOFw4ZjhwOA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCQ5TzlmO3Y7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCU4Mzg/OFI4bTg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCY4OThOOHQ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCY5NjlVOVw5aTlxOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCg4Ojg/OFI4aTg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCg5TjlcOXo5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCk4Ljg8OEE4TzhUOGI4ZzhtOHc4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCk4MThLOGg4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCo4Lzg1OEA4RjhdOGQ4aThvOHk4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCo4Lzg9OEI4UDhVOGM4aDh2OHs4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCo4OzhIOGY4eDg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCo4SDhPOFY5ZDl1OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCs4MjhAOEc4VThcOGo4cTg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCs4UThkOHc4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OCw4UjhlOHg4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"ODA5QjlKOWE5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"ODE4SjhfOHE4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"ODU4PDhJOFE4azg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"ODY4QzhkOHU4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"ODY5PTlqOXQ5fTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OGA6ZDpoOmw6cDp0Ong6fDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OEJGaGhLTCg2NjYoJSMiKCg2NjYoJiEoNjYpKSkmJiYpNicnICAmKTYuPy0gJiknLj8/PycgJy4vPz8/LiY9LS8/QEBAPjMuMEBPQEA/NC9AT09PQEA0Oy0pNzBAT09PQEA0QSwqNTBPU1RTT0A1Qz82Q0BPVFRUU0A2QFNUVlZTUz5PU1ZWVlZTQFpPVFZXV1dWVTpPVFZXV1VBcU9UVldPVlZXT1ZWV09WV1dzbm5jNkNmRFBJWVJSTk4xK1RSTjExK04xMSsqMSsrKk8rKidBUGVlPVByZWU9SHFldDtIcWV0dyd1OkhvZHF3d3J0J28zOkhaX2FaYXF3Jz0jJSUiIiIiNjY2NjY2NnV1dXV5Xl5eSUl4PT0wJHUgPkAzJHU9QUY0J3Y+R0dFL3Y/R0lINXZGSUtKSFF2R0lLamhDdkdKS2tvblN2R0pqdk5ueHpnbHh4dWNMNjdCN3pObG54ek5pbnh8eU1ncnh8eUJpbXZ+ZUJTaXZ9cDZTU3V6enZ6fV42U1x1dXF1enpPLFFSW1NddXkmJigkJSkrMjZMTExQOjpiWlpaZEhISCRISEhISEhgTExMM0xMTExMTGZYKi14VSwrXks0OF9LMy1dSjRJSUlFYl1SSUlJfl4vMm88NDArdklJSE9PT3hSUlIkPT09L1dWVW89PT09PT08aWdjdD09PT09PTdnZ2c9PT1aZ2dnZmRfdGdnZ3BwcH1ZVlRveHh4aj09PVN9fX1aPT09K01MSms9PT09PT0xfHx8QUFAaHx8fCJ2dnZ8fHA6bWhZaGZhVWlpaXVXMyRpRkhxTiVbd1k1cn5nS3VqXHRxaV1ddm1adyF7enleIGF+WyxOVz8gX1A6IGhlYC5gX19ha2poZ3h3dj52dnNweXl4aw==","type":"Ansi","source":"File String Dumps","process":null,"filename":"repairic","compromised":null,"detection_total":null,"total":null},{"value":"OFByZXNzIHRoZSBGaW5pc2ggYnV0dG9uIHRvIGluc3RhbGwgdGhlIG1haW4gYXBwbGljYXRpb24u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSE5OTlWOWA5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSI5Jzk1OTo5SDlNOVs5YDluOXM5eTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSI5VjloOXs5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSM5KTk0OTo5UTlWOVw5ZzltOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSM5OzlHOVQ5YTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSQ5KTk3OTw5TTlxOX05","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSQ6SjpaOm06","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSU5LDk5OUE5WTl2OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSY6ODpSOlg6XzpmOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSc6ODpIOk86YTo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSc6QDpPOmY7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSg5LjlFOUo5UDlbOWE5eDl+OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSk5Ljk0OT45STlPOVk5cDl1OXs5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSs5NjlAOVk5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OSs5PjlROXc5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OS85ODk+OUo5WzlgOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OTI5WDlmOXY5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OTM6WjphOiY7NztGPFg8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OTU5QDlKOSI6OjpdOnU6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OTg4NTIxMGphXVpaWldWVlZNZ2JLS0pJSEc6NzY0VmJLY2NjY2NjY2M0VmJLY2NjY2NjY2M0Vi89PT0rYktjY2NjY2NjYzRWKz09PT09PT09JjJnVzpOTk5OTk5OTiBMZyY9PT09QEJCQisrQkJCQisrKysmJiYmJiYmJiYmJiYmJiYmJiYmJiYmKysrK09RUVErPUJCQkJCQkJCQkJCQkJCQkJCQj0rUVFRUVtfX18rPUJCQkJCQkJCQkJCQkJCQkJCQj0rX19fX11kZGQrQkJCQkJCQkJCQkJCQkJCQkJCQkIrZGRkZF9kZGQrQkVFRUVFRUVFRUVFRUVFRUVFRUIrX0I9ZGRkX2QrT09PT09PT09PT09PT09PT09PT08rZ19fZ2RbRlMrT09PT09PT09PT09PT09PT09PT08rampqamdqamorT1NTU1NTU1NTU1NTU1NTU1NTU08rZEJCaitTU1NTU1NTU1NTU1NTU1NTU1NTUytqZ2crU1tbW1tbW1tbW1tbW1tbW1tbW1MrK1tbW1tbW1tbW1tbW1tbW1tbW1tbK2RCQitfX19fX19fX19fX19fX19fX19fXytkZGRkK19kZGRkZGRkZGRkZGRkZGRkZGRfK2RkZGQkJCQkJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiQkJCQ5ZGRkZGRkZGRkZGRkZGQ5Z2dnZ2dnZ2dnZ2dnZ2c5ampqampqampqampqamo5ODg1MjEwcWhoZnFoaHFoaHVUVFNLXV1cVFRTPFRUUypbW1pUVFMn","type":"Ansi","source":"File String Dumps","process":null,"filename":"printico","compromised":null,"detection_total":null,"total":null},{"value":"OUNgdTk5Q1x0NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OUY5VDlsOXM5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OUg6VzpmOms6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OXNgdEs5c2R0Rg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiA6LjozOkE6RjpUOlk6ZzpsOn06","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiE6Jzo2OkM6VjpiOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiE6Njo9Ok06bTo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiE7ODthO3c7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiQ6KTo8Okc6XTo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiQ6ODpKOl06fDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiQ7KDssO3Y7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiU6Kzo1Okw6UTpXOmI6aDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiU6Lzo9Okc6UTphOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiU6PDpBOkc6UjpYOm86dDp6Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiU7PTtVO3I7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiY6Ljo1OkY6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OiY7NDtMO1M7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Oic6PDpIOk46VDpiOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ois7XztkO247","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Oiw6MzpmOnQ6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Oi46RDpOOl06ZDo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Oi47cztmPHY8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OjA6OjpCOkk6Wjo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OjE6Njo8Okc6TTpkOmk6bzp6Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OjE7VDtlO3I7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OjI6OTpCOlQ6WTpsOnc6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OjY7RjtlO2w7eTs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OjtGO1Y7dTt8Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OmY6eDomPDg8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Okg7TztYO2o7bzs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$77","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OlY7YzthPHY8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyA8PDxRPGQ8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyE7JzsyOzg7TztUO1o7ZTtrOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyE7Kjs8O0E7UjtqO3s7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyE7ODs9O0M7TjtUO2s7cDt2Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyE8LjxrPjQ/SD9ePw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyI7MTtBO0s7ZjtzOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyI7Mzs4O0I7UztYO2I7czt4Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyI7NztmO3Q7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyI8RjxbPGw8djw2PUQ9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyI8VjxjPHo8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyM7MTs2O0Q7STtXO1w7ajtvO307","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyQ8RTxVPGM8fDw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyU7Kjs0O0s7XDtgO2Y7bTt4O347","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OyU7LDs5O0E7Wzt4Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Oyk7Ljs0O0s7UDtYO187ZTtvOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Oyo7PTtQO2U7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Oys7OTtGO1k7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OzI7OztaO3g7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"OzU7TTtiO3Y7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ozk8QzxOPFk8YzxtPHc8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ozs7OzE7Ozs0Q0ZoaEtMLyQ7IyQ7PTskJT09OyQjJT1BQTw6KiQnQU5BQTsrJUFOTk5BPCsnQU5OTkE8Kz4iICwnTlZXVk5BLEU/MURBTldXV1ZBMEFWV1lZVlY6TlZZWVlZVkBcOzs7OzE7OztOV1laWlpZWDZOV1laWlhCck5XWVpOWVlaTllZWk5ZWlp0ZGRkLi4yJigoKFVVTU0oIVdVTSgoIU0oKCEgKCEhIFBSX35CUGZ+fj5QZmZ+Ozs7OzE7Ozs+UHNmZj5IcmZ1N0hyZnV4djZIcGVyeHhzdW4qNkhcYWJcYnJ4Ly8vLy8vLnZ2dnZ6YGBgSUl5WCoteFUsK15LNDhfSzMtXUo0Xi8ybzw0MCt2PDgyP0hBOkA+PDpHQTpUU1BwQD48MT49PTg9PT04c3Rzfj09PTc9PT1aZmRfdD09PT09PSk9PT0qPT09JllWVG89PT1SUE5tZGJddD09PS5OTUpsPT09KkA+PEc9PT0=","type":"Ansi","source":"File String Dumps","process":null,"filename":"completi","compromised":null,"detection_total":null,"total":null},{"value":"Ozs7OzE7Ozs0Q0ZoaEtMLyQ7IyQ7PTskJT09OyQjJT1BQTw6KiQnQU5BQTsrJUFOTk5BPCsnQU5OTkE8Kz4iICwnTlZXVk5BLEU/MURBTldXV1ZBMEFWV1lZVlY6TlZZWVlZVkBcOzs7Ozs7OztOV1laWlpZWDZOV1laWlhCck5XWVpOWVlaTllZWk5ZWlp0ZGRkLi4yJigoKFVVTU0oIVdVTSgoIU0oKCEgKCEhIFBSX35CUGZ+fj5QZmZ+Ozs7OzE7Ozs+UHNmZj5IcmZ1N0hyZnV4djZIcGVyeHhzdW4qNkhcYWJcYnJ4Ly8vLy8vLnZ2dnZ6YGBgSUl5LS0qIWMtNTUsIWMtOjotIWU1Ozs2K2Y2PT47LmY6PkBAPEdmOj5bXEA4Zjs+W2FgX0lmO0BbcWY7W2t2cXRoUG4/aXR0dHV1d3dvWV1pdHN1bUNdaWtzdW1CWWlrc3dtQllpbHNYN0haaHdWN0paZnBUN0pKY21oaW9wUjdJUVFiY2Ntb0QnRUdQSVFjbSEhIiEjJCsmN0FBQUEyN1JYKi14VSwrXks0OF9LMy1dSjReLzJvPDQwK3Y8ODI/SEE6QD48OkdBOlRTUHBAPjwxPj09OD09PThzdHN+PT09Nz09PVpmZF90PT09PT09KT09PSo9PT0mWVZUbz09PVJQTm1kYl10PT09Lk5NSmw9PT0qQD48Rz09PW5GeHE+","type":"Ansi","source":"File String Dumps","process":null,"filename":"custicon","compromised":null,"detection_total":null,"total":null},{"value":"OzwxPEE8VjxlPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"O0A7VTtkO287","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"O2wkUHMpO3wkcHMj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"O1FMdSY7UVB1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCA8NjxAPEs8UTxcPGE8Zzx+PA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCE8NDxYPHU8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCE9Rj1WPWk9cD19PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCI8Mzw4PEI8UzxYPGI8cTw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCQ8Kjw1PDs8UjxXPF08aDxuPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCQ8OjxPPHU8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCY8MzxLPF08","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCY8NzxoPHY8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCg8YTx0PH48","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCg9Lj04PUI9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCg9Lz04PUo9Tz1iPXk9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCk9Oz1rPVE+cD4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCo8Lzw9PEI8UDxVPGM8aDx2PHs8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCo9Rj1bPW49","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCs8NzxEPGY8dDw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PCw9Rj1WPXc9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PC0tLS0tLS0tLS0tLS0tLS0tLS0tTU9SRS0tRlJBTUVTLS0tLS0tLS0tLS0tLS0tLS0tLS0+","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PC48QDxTPHU8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PC88NDw6PEU8SzxiPGc8bTx4PH48","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PC89VD1mPW49eT0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$78","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$79","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$7a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$7b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$7c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$7d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$7e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDQ+Qj5KPlA+Vj5gPnY+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDY9RD13PX49","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDY9Rj1lPWw9eT0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDg9Pz1IPVo9Xz1yPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDk8Szx1PXM+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDwgQWR2YW5jZWQgSW5zdGFsbGVyICh4ODYpIExvZyA+Pg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PD0mPTA9Zj11PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PD09TD1dPW49fD0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$7f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PF49Ij4/Pm8+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PGEgaHJlZj0i","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PGJvZHk+PGgzIHN0eWxlPSJjb2xvcjpncmVlbjsiPkVycm9yIGxvYWRpbmcgcmVzb3VyY2U6PC9oMz48cCBzdHlsZT0id2hpdGUtc3BhY2U6bm93cmFwIj4iJXMiPC9wPjwvYm9keT4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$80","type":"Ansi","source":"File String Dumps","process":null,"filename":"print.png.xaml","compromised":null,"detection_total":null,"total":null},{"value":"$81","type":"Ansi","source":"File String Dumps","process":null,"filename":"nextcancelbuttons.xaml","compromised":null,"detection_total":null,"total":null},{"value":"$82","type":"Ansi","source":"File String Dumps","process":null,"filename":"metroinstallbutton.xaml","compromised":null,"detection_total":null,"total":null},{"value":"$83","type":"Ansi","source":"File String Dumps","process":null,"filename":"remove.png.xaml","compromised":null,"detection_total":null,"total":null},{"value":"$84","type":"Ansi","source":"File String Dumps","process":null,"filename":"repair.png.xaml","compromised":null,"detection_total":null,"total":null},{"value":"$85","type":"Ansi","source":"File String Dumps","process":null,"filename":"metrorunapplicationbutton.xaml","compromised":null,"detection_total":null,"total":null},{"value":"$86","type":"Ansi","source":"File String Dumps","process":null,"filename":"modify.png.xaml","compromised":null,"detection_total":null,"total":null},{"value":"$87","type":"Ansi","source":"File String Dumps","process":null,"filename":"viewreadmebutton.xaml","compromised":null,"detection_total":null,"total":null},{"value":"$88","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$89","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8a","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8c","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8d","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEY8VDxsPHM8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEY8VzwmPTc9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEY9Vj11PXw9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PEl0QzxMdDM8VHQjPGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PHNjYWxleD4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PHNjYWxleT4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$8f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$91","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PHNwcml0ZXNvdXJjZT4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$92","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$94","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$95","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$96","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$97","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PFg9Xz1oPXo9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PHhkaXNhYmxlZD4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PHhob3Zlcj4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PHhwcmVzc2VkPg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSE9Jz0yPTg9Tz1UPVo9ZT1rPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSE9Kz1EPUo9Uz1ZPWI9dT16PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSE9OT1WPWA9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSI9LT0zPUo9Tz1VPWA9Zj19PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSI9Mz04PUI9Uz1YPWI9cz14PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSI+Qz5gPnM+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSM+Tz5pPkY/VT8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSQ9Nj07PUk9Tj1cPWE9bz10PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSU+Lz4/PkU+Sj5XPmM+aT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSU+QD5bPnY+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSY9Kz0xPTw9Qj1ZPV49ZD1vPXU9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSY+NT5cPn0+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSc9NT1mPXI9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSc+ND5CPlY+Wz5hPmw+cj4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSg9Oj0/PVI9aT0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSg9Rz1iPX09","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSk+OT5iPmg+bj50Pns+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSo9Sj1sPmE/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSw9Mz1mPXQ9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSw9Nj0+PUU9Vj0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PSw9Qj1nPX09","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PS49Qz1KPVo9ej0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PS89PT1iPXM9Yj5+Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PS8+Qj57Pm4/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PTg+Pz5IPlo+Xz5yPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PTg+QT5NPlY+XD5xPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PTo+RD5WPnM+fT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PT09PT09IFN0YXJ0aW5nIGxvZ2dpbmcgb2YgIg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PT09PT09PT09PT09PT09PT09PT09RW5kIG9mIExvZz09PT09PT09PT09PT09PT09PT09PQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PVg+Xz5oPno+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiA+Jj4xPjc+ST5XPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiE+Nj5RPmY+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiE/Oj9KP1Q/YT92Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiI+MD41PkM+SD5WPls+aT5uPnw+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiI+MT47Plk+Xj5jPnk+fj4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiQ+Kj5BPkY+TD5WPmE+Zz5xPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiQ+Lj4+PmM+aD5yPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiY+Lz5BPkY+Vz4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PiY/ND9jP2o/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pik+MT5LPmg+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pio+Lz41PkA+Rj5dPmI+aD5zPnk+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pio/OD9RP18/dj8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pi0+Mj44PkM+ST5gPmc+bD5yPnw+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PjI+QD5LPlo+JD83P0Q/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pj4/Uj9ZP2I/dD95Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pj8vPz8/Uj9oPw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pj9GP1Y/dT98Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pk0/bT9zP3o/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyA/Jj89P0I/SD9TP1k/cD91P3s/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyE/Jj8sPzc/PT9UP1k/Xz9qP3A/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyI/Sz9YP2s/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyM/MD9RP2g/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyQ/Lj87P0k/Vj9pPw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyU/LD85P0E/Wz94Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyU/TT9iP3I/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyY/LD80Pz8/TT8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PyY/QT9WP3E/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pyc/Oj9eP3U/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PygtfC8pK3E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pyk/MT9LP2g/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pyk/QD9FP0s/Vj9cP3M/eD9+Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pyk/Tz9iP3U/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pyo/Lz89P0I/UD9VP2M/aD92P3s/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"Pyo/Vj9oP3o/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PzA/PT9mP3Q/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PzMzMzMzMzMzMzMzMzMzMzM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"PzxwcmVyZXFfaWRfbGlzdD4gLSBzcGVjaWZpZXMgd2ljaCBwcmVyZXF1aXNpdGVzIHRvIGJlIGluc3RhbGxlZA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"P1E/ZD9uP3Y/fT8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"P1ZFUlNJT04uZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QDxhIGhyZWY9IiVzIj4lczwvYT4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QEN0cmxFdnRSZW1vdmluZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGVjaG8gb2ZmICUlU3lzdGVtUm9vdCUlXFN5c3RlbTMyXGF0dHJpYi5leGUgLXIgIiVzIiA6dHJ5IGRlbCAiJXMiIGlmIGV4aXN0ICIlcyIgZ290byB0cnklJVN5c3RlbVJvb3QlJVxTeXN0ZW0zMlxhdHRyaWIuZXhlIC1yICIlcyIgZGVsICIlcyIgfCBjbHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGVjaG8gb2ZmICUlU3lzdGVtUm9vdCUlXFN5c3RlbTMyXGF0dHJpYi5leGUgLXIgIiVzIiA6dHJ5IHJkICIlcyIgaWYgZXhpc3QgIiVzIiBnb3RvIHRyeSUlU3lzdGVtUm9vdCUlXFN5c3RlbTMyXGF0dHJpYi5leGUgLXIgIiVzIiBkZWwgIiVzIiB8IGNscw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGVjaG8gb2ZmICUlU3lzdGVtUm9vdCUlXFN5c3RlbTMyXGF0dHJpYi5leGUgLXIgIiVzIiBTRVQgY291bnQ9MCA6dHJ5ICUlU3lzdGVtUm9vdCUlXFN5c3RlbTMyXHRpbWVvdXQuZXhlICA1IFNFVCAvYSBjb3VudD0lJWNvdW50JSUrMXJkICIlcyIgaWYgJSVjb3VudCUlIEdUUiAlbHUgZ290byBicmVha2lmIGV4aXN0ICIlcyIgZ290byB0cnk6YnJlYWsgJSVTeXN0ZW1Sb290JSVcU3lzdGVtMzJcYXR0cmliLmV4ZSAtciAiJXMiIGRlbCAiJXMiIHwgY2xz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QGVjaG8gb2ZmICUlU3lzdGVtUm9vdCUlXFN5c3RlbTMyXGF0dHJpYi5leGUgLXIgIiVzIiBTRVQgY291bnQ9MCA6dHJ5ICUlU3lzdGVtUm9vdCUlXFN5c3RlbTMyXHRpbWVvdXQuZXhlIDUgU0VUIC9hIGNvdW50PSUlY291bnQlJSsxZGVsICIlcyIgaWYgJSVjb3VudCUlIEdUUiAlbHUgZ290byBicmVha2lmIGV4aXN0ICIlcyIgZ290byB0cnk6YnJlYWsgJSVTeXN0ZW1Sb290JSVcU3lzdGVtMzJcYXR0cmliLmV4ZSAtciAiJXMiIGRlbCAiJXMiIHwgY2xz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"WzEtOV06ICguKik=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0NvbW1vbkFwcERhdGFGb2xkZXJd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0N1cnJlbnRDb250cm9sRGF0YV0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0N1cnJlbnRDb250cm9sRGlhbG9nXQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0N1cnJlbnRDb250cm9sSGVscF0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0N1cnJlbnRDb250cm9sTmFtZV0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0N1cnJlbnRDb250cm9sUGFyZW50XQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0N1cnJlbnRDb250cm9sUHJvcGVydHld","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0N1cnJlbnRDb250cm9sVGV4dF0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0N1cnJlbnRDb250cm9sVHlwZV0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0ludGVybmV0U2hvcnRjdXRdVVJMPSVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W0xvY2FsQXBwRGF0YUZvbGRlcl0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1N5c3RlbUZvbGRlcl1tc2lleGVjLmV4ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1dpbmRvd3NWb2x1bWVd","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQoI2wkNCtsJCwpXCQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQwK0QkLCtcJChq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XC86Kj8iPD58","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFwuXHBpcGVcVG9TZXJ2ZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFwuXHBpcGVcVG9TZXJ2ZXJBZHZpbnN0X0V4dHJhY3RfQzpcQXV0b1RDcnlwdG9EZXNrdG9wLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb20=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb21c","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb21cQXV0b1RDcnlwdG8gRGVza3RvcCAxMDEuMS4z","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb21cQXV0b1RDcnlwdG8gRGVza3RvcCAxMDEuMS4zXA==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb21cQXV0b1RDcnlwdG8gRGVza3RvcCAxMDEuMS4zXGluc3RhbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb21cQXV0b1RDcnlwdG8gRGVza3RvcCAxMDEuMS4zXGluc3RhbGxc","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb21cQXV0b1RDcnlwdG8gRGVza3RvcCAxMDEuMS4zXGluc3RhbGxcMTAzMy5kbGw=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb21cQXV0b1RDcnlwdG8gRGVza3RvcCAxMDEuMS4zXGluc3RhbGxcQXV0b1RDcnlwdG8gRGVza3RvcC5haXVp","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVBUFBEQVRBJVxBdXRvdGNyeXB0by5jb21cQXV0b1RDcnlwdG8gRGVza3RvcCAxMDEuMS4zXGluc3RhbGxcQXV0b1RDcnlwdG8gRGVza3RvcC5tc2k=","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVVU0VSUFJPRklMRSVcQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XCVVU0VSUFJPRklMRSVcQXBwRGF0YVxSb2FtaW5n","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XEM6XFVzZXJz","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFw/XEM6XFVzZXJzXCVPU1VTRVIl","type":"Unicode","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNvZnR3YXJl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFN0cmluZ0ZpbGVJbmZvXCUwNHglMDR4XCVz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFN5c3RlbVRlbXBc","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFZhckZpbGVJbmZvXFRyYW5zbGF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFdpbmRvd3NQb3dlclNoZWxsXHYxLjBcUG93ZXJTaGVsbC5leGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XUNPTVBBRERMT0NBTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XUluc3RhbGxFeGVjdXRlU2VxdWVuY2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"XUluc3RhbGxMb2dHZW5lcmF0b3I=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jbHJjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jcnRfc3RydG94OjpmbG9hdGluZ19wb2ludF92YWx1ZTo6YXNfZG91Ymxl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19jcnRfc3RydG94OjpmbG9hdGluZ19wb2ludF92YWx1ZTo6YXNfZmxvYXQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19mYXN0Y2FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19yZXN0cmljdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zd2lmdF8x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zd2lmdF8y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zd2lmdF8z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X190aGlzY2FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X191bmFsaWduZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X192ZWN0b3JjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X0Jyb3dzZVByb3BlcnR5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2RkbGdfZXZ0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2Rvbndsb2FkX2RvbmVfZXZ0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2VkbGdfZXZ0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2lzX2RvdWJsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X25leHRhZnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3ByZXBhcmVfZXZ0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1RoaXMgaW5zdGFsbGF0aW9uIHBhY2thZ2UgaXMgbm90IHN1cHBvcnRlZCBieSB0aGlzIHByb2Nlc3NvciB0eXBlLiBDb250YWN0IHlvdXIgcHJvZHVjdCB2ZW5kb3Iu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3VpZG9uZV9ldnQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"X3VpZ29fZXZ0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YEFjdGlvbmAgPSAn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YEFjdGlvbmAgPSAnQUlfREVURUNUX1dJTlRIRU1FJyBPUiBgQWN0aW9uYCA9ICdBSV9TZXRDb250cm9sU3R5bGUnIE9SIGBBY3Rpb25gID0gJ0FJX0Nob29zZVRleHRTdHlsZXMnIE9SIGBBY3Rpb25gID0gJ0FJX0RFVEVDVF9NT0RFUk5XSU4n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGFub255bW91cyBuYW1lc3BhY2Un","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGNvcHkgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YERpYWxvZ19gID0gJw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YERpYWxvZ19gPSc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YERpYWxvZ19gPSdCcm93c2VEbGcnIEFORCBgQ29udHJvbGA9J0RpcmVjdG9yeUNvbWJvJw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YERpYWxvZ2AgPSAn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YERvd25sb2FkIGZhaWxlZC4gRXJyb3I6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgYXRleGl0IGRlc3RydWN0b3IgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YEdyb3VwQm94","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YEtleWAgPSAn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBndWFyZCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YE5hbWVgID0gJw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YG9tbmkgY2FsbHNpZyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGUgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGVbXSBjbG9zdXJlJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YFNlcXVlbmNlYCA8IC0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YFNlcXVlbmNlYCA8IDA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YFNlcXVlbmNlYCA+","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YFNlcXVlbmNlYCA+IDA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YFNlcXVlbmNlYCA+PSAw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHN0cmluZyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YFR5cGVgID0gNTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHR5cGVvZic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHVkdCByZXR1cm5pbmcn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZiYXNlIGRlc3RydWN0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZidGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YHZpcnR1YWwgZGlzcGxhY2VtZW50IG1hcCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QSBtaW5vciB1cGdyYWRlIHdpbGwgYmUgYXBwbGllZCB0byB2ZXJzaW9uOg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QSB2YWxpZCBsYW5ndWFnZSB3YXMgcmVjZWl2ZWQgZnJvbSBjb21tbmFkIGxpbmUuIFRoaXMgaXM6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUFkdmFuY2VkIEluc3RhbGxlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUFJX0NPTE9SX0RJU0FCTEVEX1RFWFQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUFJX0RpcmVjdFVJV2luZG93","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUFpRXVsYVJlYWRJZ25vcmVkTGluZXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUFYV0lOIEZyYW1lIFdpbmRvdw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"$98","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUM6XFJlbGVhc2VBSVxzdHVic1xzZXR1cFxjb250cm9sc1xDaGVja0JveENvbnRyb2wuY3Bw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUM6XFJlbGVhc2VBSVxzdHVic1xzZXR1cFxjb250cm9sc1xMaXN0Qm94Q29udHJvbC5jcHA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUM6XFJlbGVhc2VBSVxzdHVic1xzZXR1cFxjb250cm9sc1xQdXNoQnV0dG9uQ29udHJvbC5jcHA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUM6XFJlbGVhc2VBSVxzdHVic1xzZXR1cFxjb250cm9sc1xRdWlja1NlbGVjdGlvblRyZWVDb250cm9sLmNwcA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUM6XFJlbGVhc2VBSVxzdHVic1xzZXR1cFxjb250cm9sc1xWb2x1bWVTZWxlY3RDb21ib0NvbnRyb2wuY3Bw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0LUVuY29kaW5nOiAlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUNDRVNTX1ZJT0xBVElPTg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uQ291bnRGbGFncw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uQ291bnRUYWJsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uRGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uRGF0YURvbmVTdWZmaXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uRGF0YVByZWZpeA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uRGF0YVN1ZmZpeA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uTmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uUHJvcGVydHk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uVGV4dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uVGV4dERvbmVTdWZmaXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uVGV4dFByZWZpeA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uVGV4dFN1ZmZpeA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uVW5pdA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVPbkhvc3RGbGFncw==","type":"Ansi","source":"Runtime Data","process":"AutoTCryptoDesktop.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkLUFwcHhQYWNrYWdlIC1QYXRoICIlcyIgIGV4aXQgJGVycm9yLmNvdW50","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUREREVGQVVMVA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBmYW1pbHkgbm90IHN1cHBvcnRlZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBpbiB1c2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWRkcmVzcyBub3QgYXZhaWxhYmxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUREU09VUkNF","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5pc3RyYXRpdmUgVG9vbHM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5VSVNlcXVlbmNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWR2YW5jZWQgSW5zdGFsbGVy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWR2YW5jZWQgSW5zdGFsbGVyIEVuaGFuY2VkIFVJ","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWR2YW5jZWRJbnN0YWxsZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWR2YXBpMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWR2ZXJ0aXNl","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QURWRVJUSVNF","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aW5zdF8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aW5zdF9Fc3RpbWF0ZV8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aW5zdF9FeHRyYWN0Xw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QURWSU5TVF9MT0dT","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QURWSU5TVFNGWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUVTIERlY3J5cHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWZ0ZXIgcnVubmluZyBwcmVyZXF1aXNpdGVzIHdlIGhhdmU6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQXBwU2VhcmNoRXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQk9PVFNUUkFQUEVS","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQk9PVFNUUkFQUEVSX09QVElPTlM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQk9PVFNUUkFQUEVSX1JFU1VNRQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQk9PVFNUUkFQUEVSTEFORw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQk9PVFNUUkFQUEVSTEFOR1M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQk9PVFNUUkFQUEVST1JJR0lOQUxMQU5H","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQlROX0hJREVfVEVYVF8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQlROX0xJTkVBUl9CT1JERVJfU0NBTElOR18=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQlROX05PX0NPUk5FUl9TQ0FMSU5HXw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfQ0xPU0VCVE5fQkFTRV9DT0xPUg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfQ0xPU0VCVE5fQk9SREVSX0NPTE9SUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfQ0xPU0VCVE5fQ09MT1JT","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfRFJBR19GUk9NX0FOWV9QT0lOVA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfRlJBTUVfQkFTRV9JTkFDVElWRV9DT0xPUg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfRlJBTUVfQk9SREVSMV9DT0xPUlM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfRlJBTUVfQk9SREVSMl9DT0xPUlM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfRlJBTUVfQk9SREVSM19DT0xPUlM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfRlJBTUVfQ0FQVElPTjJfQ09MT1JT","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfRlJBTUVfTUVUUklDUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfRlJBTUVfU1RZTEU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfTUlOQlROX0JBU0VfQ09MT1I=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfTUlOQlROX0JPUkRFUl9DT0xPUlM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfTUlOQlROX0NPTE9SUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfUk9VTkRfQk9UVE9NX0NPUk5FUlM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfU0hBUlBfQ09STkVSUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfU1lTX0JUTlNfQk9SREVSX1dJRFRI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfU1lTX0JUTlNfU1BBQ0lORw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfU1lTX0JUTlNfWFBPUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfU1lTX0JUTlNfWVBPUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfU1lTX0JUTlNfWVBPU19GUk9NX0ZSQU1F","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfVElUTEVfVEVYVF9TVFlMRQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0ZfVFlQRQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ2hhaW5lZFBhY2thZ2U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ2hhaW5Qcm9kdWN0c1BzZXVkbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0hFQ0tfQk9YX0lNQUdFUw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ2xlYW5QcmVyZXE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ0xPU0VfVElNRU9VVA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ09MTEFQU0lCTEVfR1JPVVBfQURKVVNUX0hPU1Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ09MTEFQU0lCTEVfR1JPVVBfQU5JTUFURQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ09OVFJPTF9WSVNVQUxfU1RZTEVfRVg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ29udHJvbENvbmRpdGlvbkV4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ29udHJvbEV4","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfQ291bnRSb3dBY3Rpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfRGVmYXVsdEFjdGlvbkNvc3Q=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfQUNUSVZFU1lOQ19WRVJTSU9O","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfQURNSU5fVVNFUg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfQURPQkVSRUFERVJfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfQUxM","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfQ09MT1JfUVVBTElUWQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfRElSRUNUWF9WRVJTSU9O","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfRE9UTkVUX0NPUkUzMl9WRVJTSU9O","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfRE9UTkVUX0NPUkU2NF9WRVJTSU9O","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfRE9UTkVUX0NPUkVfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfRE9UTkVUX1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfR1JBUEhJQ1NfQURBUFRFUlM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSUVfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSUlTX1NFUlZJQ0U=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSUlTX1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSU5URVJORVRfQ09OTkVDVElPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSkRLMzJfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSkRLNjRfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSkRLX1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSlJFMzJfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSlJFNjRfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfSlJFX1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfTUlOT1JfVVBHUkFERQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0FDQ0VTUzMyX1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0FDQ0VTUzY0X1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0FDQ0VTU19WRVJTSU9O","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0VYQ0VMMjAwM19QSUFfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0VYQ0VMMjAwN19QSUFfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0VYQ0VMMjAxMF9QSUFfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0VYQ0VMMzJfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0VYQ0VMNjRfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0VYQ0VMX1BJQV9WRVJTSU9O","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0VYQ0VMX1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0dST09WRTMyX1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0dST09WRTY0X1ZFUlNJT04=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0dST09WRV9WRVJTSU9O","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_total":null,"total":null},{"value":"QUlfREVURUNURURfT0ZGSUNFX0lORk9QQVRIMjAwM19QSUFfVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"AutoTCrypto Desktop.exe","compromised":null,"detection_