23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T416,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 628f3a5d40d6… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 628f3a5d40d6…. Threat score 0/100. 0/25 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4","keywords":["Clean","malware analysis","sandbox report","threat intelligence","628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4"],"about":{"@type":"SoftwareApplication","name":"RaiDrive_1.5.3.1.exe","applicationCategory":["peexe","executable"],"identifier":"628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":4,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ad3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmZ3d3d3d3d3d2ZmZmZmZmZmd3d3d3d3d3dmZmZmZmZmZnd3d3d3d3d3ZmZmZmZmZmYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==25:T88a,"RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")26:T620,Antivirus vendors marked dropped file "lzmaextractor.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ExternalUICleaner.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "aicustact.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "NetFirewall.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "decoder.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSIEDD5.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSIEF6E.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSIEE43.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSIEAB5.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSIEF4E.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSIEB42.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSI3E4C.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")27:T91b,"RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "RaiDrive_1.5.3.1.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")28:T8e0,"RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\decoder.dll" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\holder0.aiph" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C\RaiDrive.Standard.msi" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C\RaiDrive.Standard.x64.msi" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\MSIC5A7.LOG" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEAB5.tmp" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEB42.tmp" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEB63.tmp" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\repair.png" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\remove.png" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\FrameCaption.bmp" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\metrorunapplicationbutton" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_top_mid_inactive.bmp" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_bottom_right.bmp" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\installlogoicon" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\ApplicationLogo.png" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\Dialog.Background.png" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\playcircleoutline.png" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_bottom_left.bmp" "RaiDrive_1.5.3.1.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_top_left_inactive.bmp"29:Td3f,"RaiDrive_1.5.3.1.exe" queries volume information of "C:\" at 00011300-00003276-00000046-33023506677 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\sys_close_down.png" at 00011300-00003276-00000046-34904167186 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\sys_close_hot.png" at 00011300-00003276-00000046-34928900765 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\sys_close_normal.png" at 00011300-00003276-00000046-34950167429 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\sys_close_inactive.png" at 00011300-00003276-00000046-34964659297 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\sys_min_down.png" at 00011300-00003276-00000046-34979383379 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\sys_min_hot.png" at 00011300-00003276-00000046-34993530454 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\sys_min_normal.png" at 00011300-00003276-00000046-35009259702 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\sys_min_inactive.png" at 00011300-00003276-00000046-35024741068 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_top_left.bmp" at 00011300-00003276-00000046-35039947267 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_top_left_inactive.bmp" at 00011300-00003276-00000046-35055908427 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_top_mid.bmp" at 00011300-00003276-00000046-35071369587 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_top_mid_inactive.bmp" at 00011300-00003276-00000046-35085846378 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\FrameCaption.bmp" at 00011300-00003276-00000046-35101634291 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\FrameCaption.bmp" at 00011300-00003276-00000046-35116971851 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_top_right.bmp" at 00011300-00003276-00000046-35138596349 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_top_right_inactive.bmp" at 00011300-00003276-00000046-35157730223 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_left.bmp" at 00011300-00003276-00000046-35171860879 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_left_inactive.bmp" at 00011300-00003276-00000046-35188901226 "RaiDrive_1.5.3.1.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\AI_EXTUI_BIN_3276\frame_right.bmp" at 00011300-00003276-00000046-352069837062a:T716,"C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb" "C:\JobRelease\win\Release\stubs\res\emptyresdll.pdb" "C:\JobRelease\win\Release\stubs\x86\Decoder.pdb" "D:\dd\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb" "C:\JobRelease\win\Release\custact\x86\ExternalUICleaner.pdb" "C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb" "TstuHRC:\JobRelease\win\Release\custact\x86\AICustAct.pdbFFGCTL.text$di.text$mn`$@.text$x0e.text$ydp.idata$5s.00cfgs.CRT$XCAs.CRT$XCCs.CRT$XCLt.CRT$XCUt.CRT$XCZt.CRT$XIAt.CRT$XIC,t.CRT$XIZ0t.CRT$XPA4t.CRT$XPX??@A9B`BBBBBC(CPCCCCXDDDE~GHQHHHI0IKIRSDS"@@bLC:\JobRelease\win\Release\custact\x86\Prereq.pdbOOGCTL.text$diP.text$mn P.text$xpI.text$yd`\.idata$5\c.00cfg`c.CRT$XCAdc.CRT$XCCpc.CRT$XCL|c4.CRT$XCUc.CRT$XCZc.CRT$XIAc.CRT$XICc.CRT$XIZc.CRT$XPAc.CRT$XPXc.CRT$XPXAc.CRT$XPZc.CRT$XTAc.CRT$XTZcC.rdatap.rdata$r@.rdata$sxdata4.rdata$zzzdbg.rtc$IAA.rtc$IZZ.rtc$TAA.rtc$TZZ.xdata$xZ .didat$2Z .didat$3[H.didat$4T[l.didat$6\P.didat$7]<.edataL^.idata$2_.idata$3(_\.idata$4b.idata$6p" "C:\JobRelease\win\Release\custact\x86\AICustAct.pdb"2b:Taca,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "R.dg/;xa" Heuristic match: "akpC<3!@I.UY" Heuristic match: "Msl3h6.sa" Pattern match: "e.zX/vd" Heuristic match: "U#BjhO?.sv" Pattern match: "http://www.yahoo.com" Pattern match: "http://www.google.com" Pattern match: "http://www.example.com" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" Pattern match: "http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBkaMst1nJe4z6wRjdU" Pattern match: "http://sw.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSbgiNwvmjR4M%2B9oE39sZR%2FxyzMPwQUFmbeSjTjUKcRhgOxbKnGrM1ZbpsCECTcVUQEJmqK1hG6QL" Pattern match: "http://t1.symcb.com/ThawtePCA.crl0U%0++0U0" Pattern match: "http://tl.symcb.com/tl.crl0U0U%0" Pattern match: "https://www.thawte.com/cps0/+0#!https://www.thawte.com/repository0W+K0I0+0http://tl.symcd.com0&+0http://tl.symcb.com/tl.crt0" Pattern match: "https://www.advancedinstaller.com" Pattern match: "https://d.symcb.com/cps0%+0https://d.symcb.com/rpa0.+0" Pattern match: "https://d.symcb.com/cps0%+0https://d.symcb.com/rpa0@U9070531/http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0U%0" Pattern match: "http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(U!0010UTimeStamp-2048-60Un_;1y6{0U#0cNrA)8ub0" Pattern match: "G-ro.PSE/j|e1#M" Heuristic match: "X|Jy'[(K,e50)V%B0eXf$>5|GDW@xNH+'Jp/D-g.4tpyOfJFRKq4C.NC" Pattern match: "Z.lSL/:FLW;[%GrY'4?&'%-}sb.}gWB5G0`%" Heuristic match: "_cC=q/J)i)&P}s/jw\jfYFmKi'{XpR\tn!R#qA;P}1HZ52#^^US?5-5lUi1'!Cc~ z<\wp; qS:@_OdpJn4nL?:)R)^-nD@U%JAeZ`ZyiLH$)bnc3@@IR:7!+VQZygRF_QoZST0&lrtZ2}aaI{t7{X55phQ`PP2sf9Qs3t6q(vD!f5]=KvpYeyB.sN" Pattern match: "d.JEg/1bU?mUT!rjWGFb1f0" Heuristic match: "_Ez`dq(pb_2ez(A4A%F9V/6X_e{^N>chZDxBD54sc'CLZ+8=J|FzLh;@7@M8NS'.AN" Pattern match: "TcEWx.dcMO/WG.`qs2fJVdnM" Heuristic match: "Y_^[]UjhLdPQtP3PEdME.Md" Heuristic match: "Y]UjhqdPQtP3PEdME.Md" Heuristic match: "IWREFrNRjh@N']EPWEjj3fEfEfEfEfEfEfEE<<{ux`#EEtt.Md" Pattern match: "PvME.ME/EPEPE" Heuristic match: "hfd@hE+h lpE,ftE-aE.@ E/xrPP@djHE.BH" Pattern match: "cE.Ur/xBrI#+RQEExE/WDE03LPxTE1jjV^t=LTpE2,QE1xP$E}CE~rjPlQ0PHQPLPwj3hfvE4lP4PV8E1r5UrI#+RQ3jhffE5lP8PVE1r5UrI#+RQD3f8wEEEEfEE64xu8x3%3;p}tjhMi;p`E73fEEEEHEpffu+pMPRS\E}MuCEP5\E6Ur2MUrI#+RQ3EfEFEjh[M$}ECE~r6PlV0bE1Ur2MUrI#+RQ" Pattern match: "RM.M.M.M.MMp.EeMM/MG.M?.Ee|$.MM.MM.T$B|3I=J3?=;=QM-hhd-M-M-t{lptMm-xb-MZ-MR-MJ-lM7-M/-M'-M-M-M-M-T$Bd3M" Pattern match: "succesfully.iprm/groupsextract"2c:T44b,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 5B:8F:88:C8:0A:73:D3:5F:76:CD:41:2A:9E:74:E9:16:59:4D:FA:67; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Class 3 Extended Validation Code Signing CA - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US" (SHA1: 85:5A:3B:D3:A7:19:B8:90:42:48:73:42:15:3A:57:01:D1:0B:F7:D7; see report for more information)2d:T9a2,"RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "RaiDrive_1.5.3.1.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")2e:T559,"RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\en-US\setupapi.dll.mui" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "RaiDrive_1.5.3.1.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "RaiDrive_1.5.3.1.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "RaiDrive_1.5.3.1.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\msimsg.dll" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\en-US\msimsg.dll.mui" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\en-US\crypt32.dll.mui" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\en-US\winhttp.dll.mui" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\AppPatch\msimain.sdb" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\sxs.dll" "RaiDrive_1.5.3.1.exe" touched file "C:\Windows\SysWOW64\en-US\sxs.dll.mui"2f:T80c,"RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIC5A7.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEAB5.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEB42.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEB63.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEDD5.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEE43.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEF4E.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEF6E.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEFDC.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSIF00C.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSI3E4C.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSI3E6D.tmp" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Windows\Tasks\C__RaiDrive_1.5.3.1.exe.job" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\decoder.dll" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C\RaiDrive.Standard.7z" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C\RaiDrive.Standard.msi" with delete access "RaiDrive_1.5.3.1.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C\RaiDrive.Standard.x64.msi" with delete access30:T7e5,"C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIC5A7.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEAB5.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEB42.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEB63.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEDD5.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEE43.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEF4E.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEF6E.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIEFDC.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSIF00C.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSI3E4C.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSI3E6D.tmp" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\decoder.dll" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C\RaiDrive.Standard.msi" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\9CEAF7C\RaiDrive.Standard.x64.msi" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}" for deletion "C:\RaiDrive_1.5.3.1.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\holder0.aiph" for deletion31:T408,GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter FindResourceExW ConnectNamedPipe CopyFileW OutputDebugStringW GetModuleFileNameW IsDebuggerPresent GetModuleFileNameA LoadLibraryExA LoadLibraryExW CreateThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW VirtualProtect LoadLibraryA GetFileSize GetStartupInfoW CreateDirectoryW DeleteFileW GetTempFileNameW WriteFile FindNextFileW FindFirstFileW FindFirstFileExW GetProcAddress CreateFileW FindResourceW Process32NextW LockResource GetCommandLineW GetCommandLineA CopyFileExW Process32FirstW GetModuleHandleW GetTempPathW CreateProcessW Sleep VirtualAlloc GetUserNameW GetComputerNameW ShellExecuteExW FindFirstFileExA FindNextFileA ShellExecuteW RegCreateKeyExW RegCloseKey OpenProcessToken RegOpenKeyExW LookupAccountNameW StartServiceW GetTickCount OpenProcess ReadProcessMemory GetWindowThreadProcessId socket bind WSAStartup closesocket RegDeleteKeyW ExitThread32:Tb5b,"RaiDrive_1.5.3.1.exe" wrote bytes "b4360200" to virtual address "0x748A4D68" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "60128673" to virtual address "0x7501E324" (part of module "WININET.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "d83a8a74" to virtual address "0x748B01E0" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "b4368a74" to virtual address "0x748B0200" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "c0df00771cf9ff76ccf8ff760d64017700000000c011397600000000fc3e397600000000e0133976000000009457c67425e00077c6e0007700000000bc6ac57400000000cf313976000000009319c674000000002c32397600000000" to virtual address "0x74CC1000" (part of module "NSI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "b4360200" to virtual address "0x748A4EA4" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "b4368a74" to virtual address "0x748B01E4" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "b840138673ffe0" to virtual address "0x748A3AD8" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "d83a0200" to virtual address "0x748A4E38" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "d83a0200" to virtual address "0x748A4D78" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "68130000" to virtual address "0x76121680" (part of module "WS2_32.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "0efc037781ed0277ae860177c6e00077effd03772d160277c0fcff76da8f0a7760140477478d0177a8e200776089017700000000ad3712768b2d1276b641127600000000" to virtual address "0x72B21000" (part of module "WSHIP6.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "d83a8a74" to virtual address "0x748B0258" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "b4368a74" to virtual address "0x748B0278" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "7d07047781ed0277ae860177c6e00077effd03772d16027760140477478d0177a8e200776089017700000000ad3712768b2d1276b641127600000000" to virtual address "0x72B31000" (part of module "WSHTCPIP.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "f8113976201439760c113976f5163976a911397685483976b9343976a93439766834397600000000a56b1275e4851275e04d12759cc01275a3bf127592ae12750c7d127500000000" to virtual address "0x73941000" (part of module "MSIMG32.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "75dc0875273e087551c10675ee9c0675949806750fb30c75109906759097067500000000f5163976ead73a76d9173976698739760f773b760c113976a934397620143976f8113976ff10397600000000" to virtual address "0x7397E000" (part of module "MSLS31.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "b4368a74" to virtual address "0x748B025C" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "d83a8a74" to virtual address "0x748B01FC" (part of module "SSPICLI.DLL") "RaiDrive_1.5.3.1.exe" wrote bytes "b830128673ffe0" to virtual address "0x76121368" (part of module "WS2_32.DLL")33:T673,"lzmaextractor.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RaiDrive.Standard.x64.msi" has type "Composite Document File V2 Document Can't read SAT" "ExternalUICleaner.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "aicustact.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "NetFirewall.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "decoder.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "RaiDrive.Standard.msi" has type "Composite Document File V2 Document Can't read SAT" "frame_bottom_left_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24" "frame_top_mid.bmp" has type "PC bitmap Windows 3.x format 3 x 1 x 24" "frame_right_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 3 x 24" "sys_close_down.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced" "sys_close_inactive.png" has type "PNG image data 28 x 26 8-bit/color RGBA non-interlaced" "backgroundprepare" has type "PC bitmap Windows 3.x format 5 x 5 x 24" "repair.png" has type "PNG image data 732 x 163 8-bit/color RGBA non-interlaced" "checkbox" has type "PNG image data 192 x 16 8-bit/color RGBA non-interlaced" "modify.png" has type "PNG image data 732 x 163 8-bit/color RGBA non-interlaced" "8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F" has type "data" "applogoicon" has type "PC bitmap Windows 3.x format 78 x 84 x 24" "print.png" has type "PNG image data 222 x 37 8-bit/color RGBA non-interlaced" "frame_top_right_inactive.bmp" has type "PC bitmap Windows 3.x format 1 x 25 x 24"1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"activity":{"behavior_tags":["evasive"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"FrameCaption.bmp","sha256":"6d7dce6b47795cd6100b77291db04e03178fb289a49f1fdec7ff6cce23325c34","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"PrereqProgressImage.png","sha256":"728c6cc4230e5e5b6fdf152f4b9b11ac4d104fa57a39668edea8665527c3bcc2","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"background","sha256":"f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"RaiDrive.Standard.x64.msi","sha256":"42abc9075a8c9c1b07e15620e852160e3acb0f629c6be437c72b58a781136dc0","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ExternalUICleaner.dll","sha256":"c0f2dfb48a138a27238754b50252243f254ceb61680b7729955d76afb0133f32","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"NetFirewall.dll","sha256":"6d3c85bf4675d5683b12bb8a0439c52830d7dfba4cc71c2ac59971ba5ca10093","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"39dd295e0c8d52dc50e058d93082f04952dbbcf597d48855bc8f3289f24eff4f","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"PrepareDlgProgress.gif","sha256":"0ee7650c7faf97126ddbc7d21812e093af4f2317f3edcff16d2d6137d3c0544d","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ProgressImage.png","sha256":"728c6cc4230e5e5b6fdf152f4b9b11ac4d104fa57a39668edea8665527c3bcc2","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"applogoicon","sha256":"83bfdb826d2d753f31b12c1d0a62e36d96004dc32038ae85d9006ca578612b60","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"backbutton","sha256":"71836c56ec4765d858dc756541123e44680f98da255faf1ece7b83d79809b1c3","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"decoder.dll","sha256":"46804d4e48a8165cb77ba43fde59c3433964d9041cad2178ed0158738fd8f617","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ApplicationLogo.png","sha256":"2bf82d0a7e872ee3836a225b661eb2ceaa2115ed0f67869f99d533b5700f7a51","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"PreparePrereqDlgProgress.gif","sha256":"0ee7650c7faf97126ddbc7d21812e093af4f2317f3edcff16d2d6137d3c0544d","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Up","sha256":"573e3260eed63604f24f6f10ce5294e25e22fda9e5bfd9010134de6e684bab98","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"backgroundprepare","sha256":"f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"aicustact.dll","sha256":"344abeb71ddccfdb70786849cca660982fd2ab099dcd74fd0d608a05139c8db1","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"lzmaextractor.dll","sha256":"99945e924cf512a8daf12c96d9038f2306ed286a406e86e79a478d2d6e6db1df","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"0972B7C417F696E06E186AEB26286F01_ED254FF4C86483DEFAF99106D3658A7B","sha256":"e04d265fc762a0a4c816be36fb0eb43c14698aabd15b4269ef9f51012c0fb701","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F","sha256":"4e61544cc7e5fcce73e2f90939a6f89f36086b2e84c3c302cd620730abc77ab7","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"New","sha256":"4f92e804a11453382ebff7fb0958879bae88fe3366306911dec9d811cd306eed","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"backgroundsurface","sha256":"f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"RaiDrive.Standard.msi","sha256":"b4b371a1f89a2e211455af837f4925966a3196c3d7e85ccb70c536141f2bb4f3","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Dialog.Background.png","sha256":"6b383b3405b8a3b732acea2244ba91499c85e915fc4ab5b8de12584226caf143","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wininet.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\aicustact.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\de-DE\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\pl-PL\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\sys_min_down.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\PrepareDlgProgress.gif","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_right.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\sys_close_hot.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\sys_close_normal.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\sys_min_hot.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\backgroundsurface","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\it-IT\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\\9CEAF7C\\RaiDrive.Standard.msi","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\checkbox_for_list_ctrls","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\metrobuttonimage","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_bottom_left_inactive.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msimsg.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0972B7C417F696E06E186AEB26286F01_3EC5B96BCFCD5F52090B6EBBCC65FEED","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\pt-BR\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\repair.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\sys_min_inactive.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\applogoicon","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\crypt32.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\winhttp.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\el-GR\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\lv-LV\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\ru-RU\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\FrameCaption.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\Dialog.Background.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\ar-SA\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\lt-LT\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\MSIEAB5.tmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\insticon","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\optionslogoicon","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\Up","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\hu-HU\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\viewreadmebutton","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\{44D45B69-D25A-4478-8486-20BA19CEAF7C}\\9CEAF7C\\RaiDrive.Standard.x64.msi","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"C:\\Windows","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\msimsg.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\backgroundprepare","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\cs-CZ\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\ro-RO\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\ApplicationLogo.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_top_left_inactive.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\sys_close_inactive.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\sk-SK\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\sv-SE\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\ProgressImage.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\zh-TW\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"C:\\ProgramData","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\metrorunapplicationbutton","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\runapplicationbutton","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\es-ES\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\et-EE\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\zh-HK\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\MSIEB63.tmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\checkbox_for_ctrls","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\browsebutton","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\setupapi.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\A3D5BF1283C2E63D8C8A8C72F0051F5A","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0972B7C417F696E06E186AEB26286F01_ED254FF4C86483DEFAF99106D3658A7B","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\nb-NO\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_top_right.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\modify.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\cmdlinkarrow","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8828F39C7C0CE9A14B25C7EB321181BA_DC03E45EC7611F50ADAEBABE405A8C4C","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3D0AC26322348780E90E022EA217C58C","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\fr-FR\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_bottom_mid.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\removico","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\sxs.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_right_inactive.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\exclamic","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\sys_close_down.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\PrereqProgressImage.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\ko-KR\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\da-DK\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\sr-Latn-CS\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\installlogoicon","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_left.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\repairic","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\whitebackground","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_top_mid_inactive.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\background","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\imageres.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0972B7C417F696E06E186AEB26286F01_ED254FF4C86483DEFAF99106D3658A7B","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\ja-JP\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\nl-NL\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\printico","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\completi","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\MSIEF4E.tmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\bg-BG\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\th-TH\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_top_left.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\he-IL\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_bottom_mid_inactive.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\nextcancelbuttons","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\pt-PT\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\remove.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\print.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\fi-FI\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\sl-SI\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\uk-UA\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\ExternalUICleaner.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\NetFirewall.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_bottom_right_inactive.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\hr-HR\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\waitlogoicon","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\PreparePrereqDlgProgress.gif","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_top_mid.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\custicon","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\metroinstallbutton","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"C:\\RaiDrive_1.5.3.1.exe","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\MSIC5A7.LOG","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\AppPatch\\msimain.sdb","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\sxs.dll.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\tr-TR\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_bottom_left.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\New","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\checkbox","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_bottom_right.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_top_right_inactive.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\sys_min_normal.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\backbutton","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\info","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\MSIEDD5.tmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%WINDIR%\\SysWOW64\\zh-CN\\sxs.DLL.mui","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"C:\\RaiDrive_1.5.3.1.exe.config","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\playcircleoutline.png","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\frame_left_inactive.bmp","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%TEMP%\\AI_EXTUI_BIN_3276\\lzmaextractor.dll","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"path":"C:\\share","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_cfa8acd21d4d525GOL.7A5CISM_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"name":"Global\\MSILOG_cfa8acd21d4d525GOL.7A5CISM_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["sspicli.dll","wship6.dll","mscoreei.dll","dhcpcsvc.dll","dbghelp.dll","clr.dll","wininet.dll","duser.dll","uxtheme.dll","api-ms-win-core-synch-l1-2-0.dll","SensApi.dll","WSHTCPIP.DLL","ntmarta.dll","imageres.dll","ntdll.dll","secur32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","dnsapi.dll","version.dll","psapi.dll","devobj.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","msi.dll","shlwapi.dll","userenv.dll","msimg32.dll","msihnd.dll","msls31.dll","msasn1.dll","wow64.dll","rasadhlp.dll","msctf.dll","sechost.dll","msisip.dll","KernelBase.dll","api-ms-win-downlevel-version-l1-1-0.dll","ws2_32.dll","gpapi.dll","advapi32.dll","lpk.dll","riched20.dll","FWPUCLNT.DLL","urlmon.dll","rsaenh.dll","apphelp.dll","WindowsCodecs.dll","comdlg32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","cryptsp.dll","bcrypt.dll","crypt32.dll","iertutil.dll","mswsock.dll","wow64win.dll","user32.dll","cryptbase.dll","wintrust.dll","ExplorerFrame.dll","fusion.dll","cabinet.dll","msvcrt.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","sxs.dll","ncrypt.dll","cryptnet.dll","nsi.dll","rpcrt4.dll","Wldap32.dll","propsys.dll","wow64cpu.dll","profapi.dll","shell32.dll","ole32.dll","kernel32.dll","gdi32.dll","dwmapi.dll","oleaut32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msvcr100.dll","bcryptprimitives.dll","dui70.dll","webio.dll","IPHLPAPI.DLL","imm32.dll","winhttp.dll","mpr.dll","comctl32.dll","dhcpcsvc6.dll","normaliz.dll","msimsg.dll","cfgmgr32.dll","clbcatq.dll","winnsi.dll","mscoree.dll","RpcRtRemote.dll","mstask.dll","setupapi.dll","credssp.dll","GdiPlus.dll","usp10.dll"],"processes":[{"command_line":"","icon":"$24","name":"RaiDrive_1.5.3.1.exe","normalized_path":"C:\\RaiDrive_1.5.3.1.exe","pid":3276,"ppid":0,"sha256":"628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4","uid":"00011300-00003276"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Extracted Files","TOR analysis"],"sandbox_reports":[{"analysis_start_time":"2019-03-07T20:37:37+00:00","environment_description":"Windows 7 64 bit","environment_id":120,"id":"5c81831f028838c35ec9b7eb","indicators_count":{"informative":32,"malicious":4,"suspicious":29},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"RaiDrive_1.5.3.1.exe","tags":["Extracted Files","TOR analysis"],"verdict":"clean"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":24,"files_deleted_count":0,"files_written_count":164,"http_requests_count":0,"imported_dlls_count":100,"injected_processes_count":0,"mutex_created_count":2,"process_count":1,"registry_keys_created_count":0,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"script_calls_count":0,"spawned_processes_count":1}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{},"av_detections":{"engines":{"aegislab":{"data_source":"MetaDefender","name":"AegisLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bytehero":{"data_source":"MetaDefender","name":"ByteHero","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cyren":{"data_source":"MetaDefender","name":"Cyren","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"ikarus":{"data_source":"MetaDefender","name":"IKARUS","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"kaspersky":{"data_source":"MetaDefender","name":"Kaspersky","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"quickheal":{"data_source":"MetaDefender","name":"Quick Heal","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicro":{"data_source":"MetaDefender","name":"Trend Micro","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicrohousecall":{"data_source":"MetaDefender","name":"Trend Micro HouseCall","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xvirusantimalware":{"data_source":"MetaDefender","name":"Xvirus Anti-Malware","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Found a string that may be used as part of an injection method"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"details_count":3,"name":"Fingerprint","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"details":[{"detail":"Tries to access unusual system drive letters"},{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"details_count":2,"name":"Spreading","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Input Capture"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1168","identifiers":[{"type":"malicious","value":"Loads the task scheduler interface DLL"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Execution","technique":"Local Job Scheduling"},{"attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Persistence","technique":"Hooking"},{"attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Persistence","technique":"Kernel Modules and Extensions"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to read monitor info"},{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Discovery","technique":"Peripheral Device Discovery"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Data Compressed"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"$25","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"System Security","description":"\"RaiDrive_1.5.3.1.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1215","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"ExternalUICleaner.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"aicustact.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"NetFirewall.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"decoder.dll\" was detected as \"Borland Delphi 3.0 (???)\"","id":"static-18","level":"informative","mitre_attack_id":"T1002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"cpuid at 00011300-00003276-23319-123-009A1031\n cpuid at 19377-165-1000650C\n cpuid at 23278-165-10014059\n cpuid at 38092-164-1002B298\n cpuid at 55311-164-10020E48","id":"stream-13","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to query CPU information","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00011300-00003276-23319-20-009A21B6\n GetLocalTime@KERNEL32.DLL at 00011300-00003276-23319-116-00948470\n GetSystemTime@KERNEL32.DLL at 00011300-00003276-23319-2339-0099C6A0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00011300-00003276-23319-2846-009B2113\n GetSystemTime@KERNEL32.DLL at 00011300-00003276-23319-3180-00949E20\n GetSystemTimeAsFileTime@KERNEL32.dll at 23278-822-10018A16","id":"stream-2","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query machine time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"External Systems","description":"0/62 Antivirus vendors marked sample as malicious (0% detection rate)","id":"avtest-1","level":"informative","name":"Sample was identified as clean by Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"$27","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"$28","id":"api-4","level":"informative","name":"Creates a writable file in a temporary directory","origin":"API Call","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found 40 calls to GetProcAddress@KERNEL32.dll at 19377-1200-100057AA\n Found 40 calls to GetProcAddress@KERNEL32.dll at 38092-2129-1002A17D\n Found 29 calls to GetProcAddress@KERNEL32.dll at 55311-1630-1001FEE2\n Found 11 calls to GetProcAddress@KERNEL32.dll at 55311-2132-1001FDF2","id":"stream-40","level":"suspicious","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"LookupAccountNameW@ADVAPI32.dll at 55311-282-1001BFB0","id":"stream-28","level":"informative","name":"Contains ability to lookup the windows account name","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Network Related","description":"Heuristic match: \"BRaiDrive 1.5.3.1 Standard Editio\"\n \"15.7.0.0\"","id":"string-14","level":"suspicious","name":"Found potential IP address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Raw size of \".data\" is zero","id":"static-5","level":"informative","name":"PE file contains zero-size sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found API call GetSystemTime@KERNEL32.DLL directly followed by \"cmp eax, 06h\" and \"ja 0099C9E0h\" at 00011300-00003276-23319-2339-0099C6A0","id":"stream-39","level":"informative","name":"Makes a code branch decision directly after an API that is environment aware","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"\"RaiDrive_1.5.3.1.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72E40000","id":"module-2","level":"informative","mitre_attack_id":"T1179","name":"Loads rich edit control libraries","origin":"Loaded Module","sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"lzmaextractor.dll\" claimed CRC 42088 while the actual is CRC 20657170\n \"ExternalUICleaner.dll\" claimed CRC 208106 while the actual is CRC 42088\n \"aicustact.dll\" claimed CRC 397237 while the actual is CRC 208106\n \"NetFirewall.dll\" claimed CRC 467394 while the actual is CRC 397237","id":"static-0","level":"suspicious","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"\"RaiDrive_1.5.3.1.exe\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"\"lzmaextractor.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"ExternalUICleaner.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"aicustact.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"NetFirewall.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"decoder.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSIEDD5.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSIEF6E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSIEE43.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSIEAB5.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSIEF4E.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSIEB42.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSI3E4C.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","id":"binary-1","level":"suspicious","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetAsyncKeyState@USER32.DLL at 00011300-00003276-23319-3045-0095A810\n GetAsyncKeyState@USER32.DLL at 00011300-00003276-23319-3058-009591C0","id":"stream-12","level":"suspicious","mitre_attack_id":"T1056","name":"Contains ability to retrieve keyboard strokes","origin":"Hybrid Analysis Technology","relevance":8,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"\"RaiDrive_1.5.3.1.exe\" touched \"Microsoft Windows Installer Message RPC\" (Path: \"HKCU\\CLSID\\{000C101D-0000-0000-C000-000000000046}\\DLLVERSION\")\n \"RaiDrive_1.5.3.1.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"RaiDrive_1.5.3.1.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"RaiDrive_1.5.3.1.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")\n \"RaiDrive_1.5.3.1.exe\" touched \"Scheduling Agent Service Class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{148BD52A-A2AB-11CE-B11F-00AA00530503}\\TREATAS\")\n \"RaiDrive_1.5.3.1.exe\" touched \"Msi install server\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\TREATAS\")\n \"RaiDrive_1.5.3.1.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\TREATAS\")","id":"registry-72","level":"informative","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$29","id":"api-11","level":"informative","mitre_attack_id":"T1120","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"$2a","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"\"RaiDrive_1.5.3.1.exe\" loaded module \"%WINDIR%\\SysWOW64\\mstask.dll\" at 72A10000","id":"module-5","level":"malicious","mitre_attack_id":"T1168","name":"Loads the task scheduler interface DLL","origin":"Loaded Module","relevance":5,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"DllGetVersion@COMCTL32.DLL at 00011300-00003276-23319-320-00950EA0\n GetVersionExW@KERNEL32.DLL at 00011300-00003276-23319-3147-008DE5C0","id":"stream-3","level":"informative","name":"Contains ability to query the machine version","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"CreateNamedPipeW@KERNEL32.DLL at 00011300-00003276-23319-638-0094B3C0\n CreateNamedPipeW@KERNEL32.DLL at 00011300-00003276-23319-1024-0096AD80","id":"stream-45","level":"informative","name":"Contains ability to create named pipes for inter-process communication (IPC)","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Network Related","description":"$2b","id":"string-3","level":"informative","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"System Security","description":"\"RaiDrive_1.5.3.1.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1112","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RaiDrive_1.5.3.1.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"suspicious","mitre_attack_id":"T1012","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"RaiDrive_1.5.3.1.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")\n \"RaiDrive_1.5.3.1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","id":"registry-25","level":"suspicious","mitre_attack_id":"T1012","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"\"RaiDrive_1.5.3.1.exe\" searching for class \"Shell_TrayWnd\"","id":"api-70","level":"informative","mitre_attack_id":"T1010","name":"Scanning for window names","origin":"API Call","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"$2c","id":"certificate-0","level":"informative","mitre_attack_id":"T1116","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"OpenServiceW@ADVAPI32.DLL at 00011300-00003276-23319-661-0099CB00","id":"stream-14","level":"suspicious","mitre_attack_id":"T1035","name":"Contains ability to open/control a service","origin":"Hybrid Analysis Technology","relevance":8,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RaiDrive_1.5.3.1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"suspicious","mitre_attack_id":"T1012","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00011300-00003276-23319-3299-00923CE0\n CreateToolhelp32Snapshot@KERNEL32.dll at 55311-468-1001AF70","id":"stream-20","level":"suspicious","mitre_attack_id":"T1215","name":"Contains ability to enumerate processes/modules/threads","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"System Security","description":"$2d","id":"registry-19","level":"suspicious","mitre_attack_id":"T1112","name":"Modifies Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetProcessHeap@KERNEL32.DLL at 00011300-00003276-23319-98-00892430\n GetProcessHeap@KERNEL32.DLL at 00011300-00003276-23319-338-0099EA69\n GetProcessHeap@KERNEL32.DLL at 00011300-00003276-23319-341-0099E922\n GetProcessHeap@KERNEL32.DLL at 00011300-00003276-23319-597-0099E9BD\n GetProcessHeap@KERNEL32.DLL at 00011300-00003276-23319-598-0099E85C\n GetProcessHeap@KERNEL32.DLL at 00011300-00003276-23319-599-0099E952\n GetProcessHeap@KERNEL32.dll at 19377-1171-10011F2A\n GetProcessHeap@KERNEL32.dll at 23278-1344-1001A281\n GetProcessHeap@KERNEL32.dll at 38092-2700-1003BBBD\n GetProcessHeap@KERNEL32.dll at 55311-2131-1002CBCD","id":"stream-31","level":"informative","name":"Possibly tries to detect the presence of a debugger","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"$2e","id":"api-55","level":"informative","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetMonitorInfoW@USER32.DLL at 00011300-00003276-23319-355-008C2320","id":"stream-62","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to read monitor info","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"FindResourceW@KERNEL32.DLL at 00011300-00003276-23319-89-008927B0\n LoadResource@KERNEL32.DLL at 00011300-00003276-23319-93-00892660\n FindResourceExW@KERNEL32.DLL at 00011300-00003276-23319-94-008925B0\n FindResourceW@KERNEL32.DLL at 00011300-00003276-23319-498-008FCA50\n LoadResource@KERNEL32.DLL at 00011300-00003276-23319-3478-008FFF30","id":"stream-32","level":"suspicious","name":"Contains ability to find and load resources of a specific module","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"LsaAddAccountRights@ADVAPI32.dll at 55311-282-1001BFB0","id":"stream-19","level":"malicious","name":"Contains ability to modify user account rights","origin":"Hybrid Analysis Technology","relevance":7,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\"RaiDrive_1.5.3.1.exe\" at 00011300-00003276-00000033-13106616824","id":"api-10","level":"suspicious","name":"Queries kernel debugger information","origin":"API Call","relevance":6,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"System Destruction","description":"$2f","id":"api-25","level":"suspicious","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00011300-00003276-23319-2-009A1F7F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011300-00003276-23319-72-008FB6B0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011300-00003276-23319-79-009A62BF\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011300-00003276-23319-119-009A1799\n SetUnhandledExceptionFilter@KERNEL32.dll at 19377-800-10005F5A\n SetUnhandledExceptionFilter@KERNEL32.dll at 23278-878-10013BF5","id":"stream-4","level":"informative","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"\"RaiDrive_1.5.3.1.exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","id":"api-6","level":"suspicious","name":"Reads configuration files","origin":"API Call","relevance":4,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00011300-00003276-23319-72-008FB6B0\n NtdllDefWindowProc_W@NTDLL.DLL at 00011300-00003276-23319-305-0088A5F0\n NtdllDefWindowProc_W@NTDLL.DLL at 00011300-00003276-23319-307-0088ABA0\n NtdllDefWindowProc_W@NTDLL.DLL at 00011300-00003276-23319-3745-0089CD10","id":"stream-22","level":"malicious","name":"Contains native function calls","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"RaiDrive_1.5.3.1.exe\" touched \"K:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"L:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"M:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"N:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"O:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"P:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"Q:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"R:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"S:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"T:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"U:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"V:\"\n \"RaiDrive_1.5.3.1.exe\" touched \"W:\"","id":"api-31","level":"malicious","mitre_attack_id":"T1083","name":"Tries to access unusual system drive letters","origin":"API Call","relevance":9,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API CorExitProcess@MSCOREE.DLL at 00011300-00003276-23319-11-009AF4A5\n Found reference to API IsWow64Process@KERNEL32.DLL at 00011300-00003276-23319-292-00910CA0\n Found reference to API DllGetVersion@COMCTL32.DLL at 00011300-00003276-23319-320-00950EA0\n Found reference to API LoadIconMetric@COMCTL32.DLL at 00011300-00003276-23319-358-009125A0\n Found reference to API IsWow64Process@KERNEL32.DLL at 00011300-00003276-23319-789-00902B70\n Found reference to API RegDeleteKeyExW@KERNEL32.DLL at 00011300-00003276-23319-3482-008FF340","id":"stream-41","level":"informative","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"EnumSystemLocalesW@KERNEL32.DLL at 00011300-00003276-23319-846-009B1D04\n GetUserDefaultLCID@KERNEL32.DLL at 00011300-00003276-23319-850-009B2169\n GetUserDefaultLCID@KERNEL32.DLL at 00011300-00003276-23319-863-009B650A\n EnumSystemLocalesW@KERNEL32.DLL at 00011300-00003276-23319-864-009B5E4A\n EnumSystemLocalesW@KERNEL32.DLL at 00011300-00003276-23319-865-009B5F30\n EnumSystemLocalesW@KERNEL32.DLL at 00011300-00003276-23319-868-009B5E95","id":"stream-49","level":"informative","name":"Contains ability to query the system locale","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00011300-00003276-23319-365-0093DB70\n GetDiskFreeSpaceExW@KERNEL32.dll at 23278-860-10006DD0\n GetDiskFreeSpaceW@KERNEL32.dll at 55311-533-10012A40","id":"stream-37","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to query volume size","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"\"RaiDrive_1.5.3.1.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","id":"registry-20","level":"informative","mitre_attack_id":"T1012","name":"Reads Windows Trust Settings","origin":"Registry Access","relevance":5,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"\"DES\" (Indicator: \"des\"; File: \"NetFirewall.dll.2890774979\")","id":"string-57","level":"suspicious","name":"Found a cryptographic related string","origin":"File/Memory","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RaiDrive_1.5.3.1.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\96B54D44A52D8744486802AB91ECFAC7\\INSTALLPROPERTIES\")","id":"registry-71","level":"suspicious","name":"Queries the installation properties of user installed products","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"System Destruction","description":"$30","id":"api-26","level":"suspicious","mitre_attack_id":"T1107","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$31","id":"static-1","level":"suspicious","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\MSILOG_cfa8acd21d4d525GOL.7A5CISM_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C\"\n \"Global\\MSILOG_cfa8acd21d4d525GOL.7A5CISM_pmeT_lacoL_ataDppA_SWBUPAH_sresU_:C\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$32","id":"hooks-8","level":"suspicious","mitre_attack_id":"T1179","name":"Installs hooks/patches the running process","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RaiDrive_1.5.3.1.exe\" queries volume information of \"C:\\\" at 00011300-00003276-00000046-33023506677","id":"api-39","level":"informative","mitre_attack_id":"T1120","name":"Queries volume information of an entire harddrive","origin":"API Call","relevance":8,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"$33","id":"binary-0","level":"informative","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"5c81831f028838c35ec9b7eb","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":0,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"mitre_attacks":{"total":17},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":32,"malicious_count":4,"suspicious_count":22,"total":58}},"summary":{"score":0,"tags":["evasive"],"verdict":"clean"}},"metadata":{"file_info":{"file_name":"RaiDrive_1.5.3.1.exe","file_size":20606184,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"d25b29054fccfd62c3ed5a8a3d014883","md5":"7fb33ae41a2f372498968d18e574e056","sha1":"71cded81d7b817ecc8b162b15378373fc217c268","sha256":"628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4","sha512":"08ad6a9adbfa8d4e401cf4119176e7c4a2ee6898094f1ce76492bbc6b24784c0ab63fee8e1fef949066e4689f08b324e805dc171d62488d343806e04cb538179","ssdeep":"393216:h1FsK/OhInjpIJPR8aIfAX6LbNAxEx9rHLkd5ZoXZ1jRAX5F5iZY/yjVcxAIe1HS:jFNOhIjSJ8aNX6n2xExFOkXrjRAcZ48O","ssdeep_chunks":["393216:h1FsK/O","393216:1FsK/Oh","393216:FsK/OhI","393216:sK/OhIn","393216:K/OhInj","393216:/OhInjp","393216:OhInjpI","393216:hInjpIJ","393216:InjpIJP","393216:njpIJPR","393216:jpIJPR8","393216:pIJPR8a","393216:IJPR8aI","393216:JPR8aIf","393216:PR8aIfA","393216:R8aIfAX","393216:8aIfAX6","393216:aIfAX6L","393216:IfAX6Lb","393216:fAX6LbN","393216:AX6LbNA","393216:X6LbNAx","393216:6LbNAxE","393216:LbNAxEx","393216:bNAxEx9","393216:NAxEx9r","393216:AxEx9rH","393216:xEx9rHL","393216:Ex9rHLk","393216:x9rHLkd","393216:9rHLkd5","393216:rHLkd5Z","393216:HLkd5Zo","393216:Lkd5ZoX","393216:kd5ZoXZ","393216:d5ZoXZ1","393216:5ZoXZ1j","393216:ZoXZ1jR","393216:oXZ1jRA","393216:XZ1jRAX","393216:Z1jRAX5","393216:1jRAX5F","393216:jRAX5F5","393216:RAX5F5i","393216:AX5F5iZ","393216:X5F5iZY","393216:5F5iZY/","393216:F5iZY/y","393216:5iZY/yj","393216:iZY/yjV","393216:ZY/yjVc","393216:Y/yjVcx","393216:/yjVcxA","393216:yjVcxAI","393216:jVcxAIe","393216:VcxAIe1","393216:cxAIe1H","393216:xAIe1HS","786432:h1FsK/O","786432:1FsK/Oh","786432:FsK/OhI","786432:sK/OhIn","786432:K/OhInj","786432:/OhInjp","786432:OhInjpI","786432:hInjpIJ","786432:InjpIJP","786432:njpIJPR","786432:jpIJPR8","786432:pIJPR8a","786432:IJPR8aI","786432:JPR8aIf","786432:PR8aIfA","786432:R8aIfAX","786432:8aIfAX6","786432:aIfAX6L","786432:IfAX6Lb","786432:fAX6LbN","786432:AX6LbNA","786432:X6LbNAx","786432:6LbNAxE","786432:LbNAxEx","786432:bNAxEx9","786432:NAxEx9r","786432:AxEx9rH","786432:xEx9rHL","786432:Ex9rHLk","786432:x9rHLkd","786432:9rHLkd5","786432:rHLkd5Z","786432:HLkd5Zo","786432:Lkd5ZoX","786432:kd5ZoXZ","786432:d5ZoXZ1","786432:5ZoXZ1j","786432:ZoXZ1jR","786432:oXZ1jRA","786432:XZ1jRAX","786432:Z1jRAX5","786432:1jRAX5F","786432:jRAX5F5","786432:RAX5F5i","786432:AX5F5iZ","786432:X5F5iZY","786432:5F5iZY/","786432:F5iZY/y","786432:5iZY/yj","786432:iZY/yjV","786432:ZY/yjVc","786432:Y/yjVcx","786432:/yjVcxA","786432:yjVcxAI","786432:jVcxAIe","786432:VcxAIe1","786432:cxAIe1H","786432:xAIe1HS","393216:jFNOhIj","393216:FNOhIjS","393216:NOhIjSJ","393216:OhIjSJ8","393216:hIjSJ8a","393216:IjSJ8aN","393216:jSJ8aNX","393216:SJ8aNX6","393216:J8aNX6n","393216:8aNX6n2","393216:aNX6n2x","393216:NX6n2xE","393216:X6n2xEx","393216:6n2xExF","393216:n2xExFO","393216:2xExFOk","393216:xExFOkX","393216:ExFOkXr","393216:xFOkXrj","393216:FOkXrjR","393216:OkXrjRA","393216:kXrjRAc","393216:XrjRAcZ","393216:rjRAcZ4","393216:jRAcZ48","393216:RAcZ48O"]},"submissions":{"first_seen":1551991586000,"last_multi_scan":1643445573000,"last_seen":1643445573000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["5c81831f028838c35ec9b7eb"]},"schema_version":"1.0.9","sha256":"628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4","threat_score":0,"unified_at":"2026-09-16T20:31:41.542Z","unified_at_epoch_ms":1789590701542,"verdict":"clean"}}]]}] 1d:null 21:[["$","title","0",{"children":"Clean Sample 628f3a5d40d6… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 628f3a5d40d6…. Threat score 0/100. 0/25 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 628f3a5d40d6… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 628f3a5d40d6…. Threat score 0/100. 0/25 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/628f3a5d40d6eede0526585cb7e8940e695a0702af2c9c62d9988ff46174c4d4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 628f3a5d40d6… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 628f3a5d40d6…. Threat score 0/100. 0/25 AV engines flagged this file. 4 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]