20:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 21:T410,"burnaware_pro_14.0_x64.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "burnaware_pro_14.0_x64.tmp" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "burnaware_pro_14.0_x64.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "PATH"; Value: "00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000") "burnaware_pro_14.0_x64.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BURNAWARE PROFESSIONAL_IS1") "burnaware_pro_14.0_x64.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BURNAWARE PROFESSIONAL_IS1") "burnaware_pro_14.0_x64.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\BURNAWARE_PRO_14.0_X64.TMP") "burnaware_pro_14.0_x64.tmp" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\BURNAWARE_PRO_14.0_X64.TMP")22:Ta9c,"burnaware_pro_14.0_x64.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "burnaware_pro_14.0_x64.tmp" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "burnaware_pro_14.0_x64.tmp" touched "Property System Both Class Factory" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "burnaware_pro_14.0_x64.tmp" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "burnaware_pro_14.0_x64.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "burnaware_pro_14.0_x64.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "burnaware_pro_14.0_x64.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "burnaware_pro_14.0_x64.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "burnaware_pro_14.0_x64.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "burnaware_pro_14.0_x64.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "burnaware_pro_14.0_x64.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "balc.exe" touched "CLSID_RecordInfo" (Path: "HKCU\WOW6432NODE\CLSID\{0000002F-0000-0000-C000-000000000046}") "balc.exe" touched "DAO.DBEngine.36" (Path: "HKCU\WOW6432NODE\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}") "balc.exe" touched "DAO.PrivateDBEngine.36" (Path: "HKCU\WOW6432NODE\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}") "balc.exe" touched "DAO.TableDef.36" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000103-0000-0010-8000-00AA006D2EA4}") "balc.exe" touched "DAO.Field.36" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}") "balc.exe" touched "Internet Explorer(Ver 1.0)" (Path: "HKCU\WOW6432NODE\CLSID\{0002DF01-0000-0000-C000-000000000046}\TYPELIB") "balc.exe" touched "Microsoft Windows Installer" (Path: "HKCU\WOW6432NODE\CLSID\{000C1090-0000-0000-C000-000000000046}\TYPELIB") "balc.exe" touched "Application Class" (Path: "HKCU\WOW6432NODE\CLSID\{0039FFEC-A022-4232-8274-6B34787BFC27}\TYPELIB") "balc.exe" touched "CImeProductObject_JK Class" (Path: "HKCU\WOW6432NODE\CLSID\{0095B496-F121-4256-96A0-09179828CC16}\TYPELIB")23:T5a0,Process "burnaware_pro_14.0_x64.tmp" (UID: 00065247-00002124) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "burnaware_pro_14.0_x64.tmp" (UID: 00065247-00002124) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "iexplore.exe" (UID: 00074304-00003452) was launched with modified environment variables: "Path" Process "BurnAware.exe" (UID: 00074402-00003496) was launched with modified environment variables: "Path" Process "iexplore.exe" (UID: 00074422-00003480) was launched with modified environment variables: "Path" Process "BurnAware.exe" (UID: 00074442-00001260) was launched with modified environment variables: "Path" Process "balc.exe" (UID: 00074687-00002976) was launched with modified environment variables: "Path" Process "balc.exe" (UID: 00074716-00001308) was launched with modified environment variables: "Path" Process "iexplore.exe" (UID: 00074815-00003972) was launched with modified environment variables: "Path" Process "iexplore.exe" (UID: 00074817-00001200) was launched with modified environment variables: "CommonProgramFiles, Path, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "iexplore.exe" (UID: 00074817-00001200) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "iexplore.exe" (UID: 00079090-00003108) was launched with modified environment variables: "Path"24:T600,Spawned process "burnaware_pro_14.0_x64.tmp" with commandline "/SL5="$301A6 15093744 189952 C:\burnaware_pro_14.0_x64.exe"" (UID: 00065247-00002124) Spawned process "BurnAware.exe" (UID: 00074228-00001524) Spawned process "iexplore.exe" with commandline "http://www.burnaware.com/" (UID: 00074304-00003452) Spawned process "BurnAware.exe" (UID: 00074402-00003496) Spawned process "iexplore.exe" with commandline "http://www.burnaware.com/" (UID: 00074422-00003480) Spawned process "BurnAware.exe" (UID: 00074442-00001260) Spawned process "iexplore.exe" with commandline "http://www.burnaware.com/" (UID: 00074471-00001148) Spawned process "balc.exe" with commandline "2" (UID: 00074687-00002976) Spawned process "balc.exe" with commandline "2" (UID: 00074716-00001308) Spawned process "balc.exe" with commandline "2" (UID: 00074716-00003932) Spawned process "iexplore.exe" with commandline "SCODEF:3480 CREDAT:275457 /prefetch:2" (UID: 00074815-00003972) Spawned process "iexplore.exe" with commandline "SCODEF:3452 CREDAT:275457 /prefetch:2" (UID: 00074817-00001200) Spawned process "iexplore.exe" with commandline "SCODEF:1148 CREDAT:275457 /prefetch:2" (UID: 00074819-00003820) Spawned process "iexplore.exe" with commandline "SCODEF:1148 CREDAT:340994 /prefetch:2" (UID: 00079090-00003108) Spawned process "iexplore.exe" with commandline "SCODEF:3452 CREDAT:4142084 /prefetch:2" (UID: 00079897-00002340) Spawned process "iexplore.exe" with commandline "SCODEF:3480 CREDAT:4142082 /prefetch:2" (UID: 00079919-00001896)25:T600,Spawned process "burnaware_pro_14.0_x64.tmp" with commandline "/SL5="$301A6 15093744 189952 C:\burnaware_pro_14.0_x64.exe"" (UID: 00065247-00002124) Spawned process "BurnAware.exe" (UID: 00074228-00001524) Spawned process "iexplore.exe" with commandline "http://www.burnaware.com/" (UID: 00074304-00003452) Spawned process "BurnAware.exe" (UID: 00074402-00003496) Spawned process "iexplore.exe" with commandline "http://www.burnaware.com/" (UID: 00074422-00003480) Spawned process "BurnAware.exe" (UID: 00074442-00001260) Spawned process "iexplore.exe" with commandline "http://www.burnaware.com/" (UID: 00074471-00001148) Spawned process "balc.exe" with commandline "2" (UID: 00074687-00002976) Spawned process "balc.exe" with commandline "2" (UID: 00074716-00001308) Spawned process "balc.exe" with commandline "2" (UID: 00074716-00003932) Spawned process "iexplore.exe" with commandline "SCODEF:3480 CREDAT:275457 /prefetch:2" (UID: 00074815-00003972) Spawned process "iexplore.exe" with commandline "SCODEF:3452 CREDAT:275457 /prefetch:2" (UID: 00074817-00001200) Spawned process "iexplore.exe" with commandline "SCODEF:1148 CREDAT:275457 /prefetch:2" (UID: 00074819-00003820) Spawned process "iexplore.exe" with commandline "SCODEF:1148 CREDAT:340994 /prefetch:2" (UID: 00079090-00003108) Spawned process "iexplore.exe" with commandline "SCODEF:3452 CREDAT:4142084 /prefetch:2" (UID: 00079897-00002340) Spawned process "iexplore.exe" with commandline "SCODEF:3480 CREDAT:4142082 /prefetch:2" (UID: 00079919-00001896)26:T70a,"Help.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Fri Jan 15 10:52:57 2021 mtime=Fri Jan 15 10:52:57 2021 atime=Mon Jan 11 17:08:54 2021 length=102230 window=hide" "urlblockindex_1_.bin" has type "data" "BurnAware Professional _64-bit_.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Fri Jan 15 10:52:56 2021 mtime=Fri Jan 15 10:52:56 2021 atime=Thu Jan 14 11:18:44 2021 length=4177568 window=hide" "Uninstall BurnAware Professional.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Fri Jan 15 10:52:52 2021 mtime=Fri Jan 15 10:52:52 2021 atime=Fri Jan 15 10:50:11 2021 length=1271013 window=hide" "urlref_httpwww.burnaware.com" has type "HTML document ASCII text" "RPNEOO3P.htm" has type "HTML document ASCII text" "5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA" has type "data" "desktop.ini" has type "empty" "M5BMR369.htm" has type "HTML document ASCII text" "favicon_4_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "~DF3E0B9936E832F028.TMP" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442" has type "data" "~DFB035E744ADECF707.TMP" has type "data" "is-6C77E.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "is-PP333.tmp" has type "data" "_63E6F1C9-5720-11EB-866C-08002793031A_.dat" has type "Composite Document File V2 Document Cannot read section info" "is-VA4MS.tmp" has type "PE32+ executable (GUI) x86-64 for MS Windows" "favicon_5_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced"27:T82e,"burnaware_pro_14.0_x64.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "burnaware_pro_14.0_x64.exe" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "burnaware_pro_14.0_x64.exe" touched file "C:\Windows\SysWOW64\netmsg.dll" "burnaware_pro_14.0_x64.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "burnaware_pro_14.0_x64.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "burnaware_pro_14.0_x64.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "burnaware_pro_14.0_x64.tmp" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "burnaware_pro_14.0_x64.tmp" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "burnaware_pro_14.0_x64.tmp" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui" "burnaware_pro_14.0_x64.tmp" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "burnaware_pro_14.0_x64.tmp" touched file "C:\Windows\SysWOW64\netmsg.dll" "burnaware_pro_14.0_x64.tmp" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" "burnaware_pro_14.0_x64.tmp" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\BurnAware Professional" "burnaware_pro_14.0_x64.tmp" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "burnaware_pro_14.0_x64.tmp" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "burnaware_pro_14.0_x64.tmp" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "burnaware_pro_14.0_x64.tmp" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\BurnAware Professional\BurnAware Professional (64-bit).lnk" "burnaware_pro_14.0_x64.tmp" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\BurnAware Professional\Help.lnk" "burnaware_pro_14.0_x64.tmp" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\BurnAware Professional\BurnAware Professional on the Web.url" "burnaware_pro_14.0_x64.tmp" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\BurnAware Professional\Uninstall BurnAware Professional.lnk"28:T46b,Pattern match: "http://schemas.microsoft.com/SMI/2" Heuristic match: "%pKLCN#!.Co" Heuristic match: ":!t'u6.NI" Pattern match: "https://sectigo.com/CPS0C" Pattern match: "crl.sectigo.com/SectigoRSACodeSigningCA.crl0s" Pattern match: "crt.sectigo.com/SectigoRSACodeSigningCA.crt0#" Pattern match: "http://ocsp.sectigo.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://sectigo.com/CPS0D" Pattern match: "crl.sectigo.com/SectigoRSATimeStampingCA.crl0t" Pattern match: "crt.sectigo.com/SectigoRSATimeStampingCA.crt0#" Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "www.burnaware.com" Heuristic match: "ocsp.sectigo.com" Pattern match: "http://www.burnaware.com/" Pattern match: "https://www.burnaware.com/" Pattern match: "https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js" Pattern match: "https://www.facebook.com/burnawarecompany" Pattern match: "https://www.twitter.com/burnaware"29:Tb83,"burnaware_pro_14.0_x64.exe" wrote bytes "7111ae007a3bad00ab8b02007f950200fc8c0200729602006cc805001ecdaa007d26aa00" to virtual address "0x765707E4" (part of module "USER32.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "b4360200" to virtual address "0x74894D68" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "d055ae746473b7740000000051c1937694989376ee9c937675dc9576273e95760fb39976000000008548bb756987bb750f77bd75d917bb75ead7bc75a934bb75f811bb752014bb754cbcbd75f516bb755414bb75ff10bb753214bb7500000000" to virtual address "0x73271000" (part of module "SHFOLDER.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "f811bb752014bb754cbcbd75f516bb75a911bb758548bb75b934bb75a934bb756834bb7500000000a56b7d76e4857d76e04d7d769cc07d76a3bf7d7692ae7d760c7d7d7600000000" to virtual address "0x73281000" (part of module "MSIMG32.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "d83a8974" to virtual address "0x748A01E0" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "b4368974" to virtual address "0x748A0200" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "b4360200" to virtual address "0x74894EA4" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "b4368974" to virtual address "0x748A01E4" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "a011ea72" to virtual address "0x760BE324" (part of module "WININET.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "b89012ea72ffe0" to virtual address "0x74893AD8" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "d83a0200" to virtual address "0x74894E38" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "d83a0200" to virtual address "0x74894D78" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "68130000" to virtual address "0x76511680" (part of module "WS2_32.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "d83a8974" to virtual address "0x748A0258" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "b4368974" to virtual address "0x748A0278" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "7111ae007a3bad00ab8b02007f950200fc8c0200729602006cc805001ecdaa007d26aa00" to virtual address "0x765707E4" (part of module "USER32.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "b4368974" to virtual address "0x748A025C" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "d83a8974" to virtual address "0x748A01FC" (part of module "SSPICLI.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "b88011ea72ffe0" to virtual address "0x76511368" (part of module "WS2_32.DLL") "burnaware_pro_14.0_x64.tmp" wrote bytes "c0dfff761cf9fe76ccf8fe760d64007700000000c011bb7500000000fc3ebb7500000000e013bb750000000094577a7525e0ff76c6e0ff7600000000bc6a797500000000cf31bb750000000093197a75000000002c32bb7500000000" to virtual address "0x761B1000" (part of module "NSI.DLL")2a:T6f2,Found malicious artifacts related to "208.100.25.83": ... URL: https://www.glorylogic.com/files/BA004.exe (AV positives: 1/83 scanned on 01/15/2021 11:00:13) URL: http://www.glorylogic.com/downloads/isoworkshop.exe (AV positives: 3/83 scanned on 01/15/2021 10:17:24) URL: https://www.glorylogic.com/iso-workshop.html (AV positives: 1/83 scanned on 01/14/2021 20:49:08) URL: https://www.glorylogic.com/image-tuner.html (AV positives: 1/83 scanned on 01/13/2021 22:17:03) URL: http://www.glorylogic.com/downloads/isoworkshop_7.6.exe (AV positives: 2/83 scanned on 01/13/2021 03:59:34) File SHA256: 58365ce7ab0281055a633b49ba8b910daee7526e81e31ff4c5dd669b7025dba5 (AV positives: 7/75 scanned on 01/11/2021 11:20:57) File SHA256: 8bb19bc73cc6095ce5d61fd516663bfe92bcbe437edc0908c18fc71b6c9aea9e (Date: 01/05/2021 18:17:01) File SHA256: 50deb21fccd2ff6c13eda7a1c4ced26815790e72b09d41913ef23cae5ced33a7 (Date: 12/31/2020 08:36:13) File SHA256: 25c800519e54f5747f0714b3dc57ec52d6743515d69e0d50ac947512eaa1ee92 (Date: 12/28/2020 08:33:16) File SHA256: 8e167e08e86163505ff97d395de2aa6d369342c00bfd00b144455f62b2ae8c8b (Date: 12/03/2020 18:13:41) File SHA256: 60e43b27a9578c04ff6ef3730c5e431d3aa6a70bfa5cc9ea8d29de0bd9fd57ca (AV positives: 1/76 scanned on 12/02/2020 07:35:37) File SHA256: 5f86770948e2e0806dd906c1e5a000513f1e190704906df7fafb61ad7e9e7d1f (AV positives: 1/76 scanned on 12/02/2020 07:12:09) File SHA256: 2b84248ab7c5dbf76eff24c73141cdcab6be8dd2eeee8baa706396d4ee9cc7f7 (Date: 11/29/2020 10:42:01) File SHA256: 5165483f233817493d6c07ab3b14a0d5d2867f1a5a954899c3e813c1dccf006c (AV positives: 8/76 scanned on 11/15/2020 23:08:20) File SHA256: 23dec51e5599d2f7474d6f870c6dd890de6a69ee917f6078e14277a929132349 (AV positives: 4/75 scanned on 08/19/2020 11:48:15)2b:T6f2,Found malicious artifacts related to "208.100.25.83": ... URL: https://www.glorylogic.com/files/BA004.exe (AV positives: 1/83 scanned on 01/15/2021 11:00:13) URL: http://www.glorylogic.com/downloads/isoworkshop.exe (AV positives: 3/83 scanned on 01/15/2021 10:17:24) URL: https://www.glorylogic.com/iso-workshop.html (AV positives: 1/83 scanned on 01/14/2021 20:49:08) URL: https://www.glorylogic.com/image-tuner.html (AV positives: 1/83 scanned on 01/13/2021 22:17:03) URL: http://www.glorylogic.com/downloads/isoworkshop_7.6.exe (AV positives: 2/83 scanned on 01/13/2021 03:59:34) File SHA256: 58365ce7ab0281055a633b49ba8b910daee7526e81e31ff4c5dd669b7025dba5 (AV positives: 7/75 scanned on 01/11/2021 11:20:57) File SHA256: 8bb19bc73cc6095ce5d61fd516663bfe92bcbe437edc0908c18fc71b6c9aea9e (Date: 01/05/2021 18:17:01) File SHA256: 50deb21fccd2ff6c13eda7a1c4ced26815790e72b09d41913ef23cae5ced33a7 (Date: 12/31/2020 08:36:13) File SHA256: 25c800519e54f5747f0714b3dc57ec52d6743515d69e0d50ac947512eaa1ee92 (Date: 12/28/2020 08:33:16) File SHA256: 8e167e08e86163505ff97d395de2aa6d369342c00bfd00b144455f62b2ae8c8b (Date: 12/03/2020 18:13:41) File SHA256: 60e43b27a9578c04ff6ef3730c5e431d3aa6a70bfa5cc9ea8d29de0bd9fd57ca (AV positives: 1/76 scanned on 12/02/2020 07:35:37) File SHA256: 5f86770948e2e0806dd906c1e5a000513f1e190704906df7fafb61ad7e9e7d1f (AV positives: 1/76 scanned on 12/02/2020 07:12:09) File SHA256: 2b84248ab7c5dbf76eff24c73141cdcab6be8dd2eeee8baa706396d4ee9cc7f7 (Date: 11/29/2020 10:42:01) File SHA256: 5165483f233817493d6c07ab3b14a0d5d2867f1a5a954899c3e813c1dccf006c (AV positives: 8/76 scanned on 11/15/2020 23:08:20) File SHA256: 23dec51e5599d2f7474d6f870c6dd890de6a69ee917f6078e14277a929132349 (AV positives: 4/75 scanned on 08/19/2020 11:48:15)2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAETEQAAAAAAAABEAAAAABERExEREAAAbu7mBAAAARERERMRERERDMzO7mAAMTERERETEREREU7M7M7mADERERERExERERFu7uzI7gAxERERERMRERERZu7uzO4AMRERERETEREREWaO7szuADERERERExERERFmf45s4AAxERERERMRERERFmjubMAAMRERERETERERERFmbswAADExERERExEREREREe4AAAAzMxERERMREREREREAAAAAMzERERETERERERERAAAAADMREREREQMRERBmbu6IAAAzEREREREGABEGZs7uiAAAMREREREURAABZszO7uAAABERERERFkZAAG7u7M7gAAEREREREWZmYBHu7ubM4AABERERERN25mER7ujujOAAAREREREYjuxhEW6PjszgABEREREW6O7sMRE+7u7McAAREREQDu7uYzMxE27uYRAAEXcQAAAA4AMzMzEREREQABEAAAAAAAADMzMzMxEREAAAAAAAAAAAAzMzMzMwAAAAAAAAAAAAAAAzMzMAAAAAAAAAAAAAAAAAMzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/8AAf/4AAA/wAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAPAAAAPwAAAP8AAAD/AAAADwAAAA8AAAAfAAAAHgAAAB4AAAAeAAAAHAAAABwGAAAcH9gAHP/4AB//+AH///wP///8f/////////////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 6de8d1875ddb… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 6de8d1875ddb…. Threat score 0/100. 0/28 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/6de8d1875ddb232e63e815caf4d89dc55b5ebcc41e997a48660ac59de0ab6eb6\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"6de8d1875ddb232e63e815caf4d89dc55b5ebcc41e997a48660ac59de0ab6eb6\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"burnaware_pro_14.0_x64.exe\",\"applicationCategory\":[\"peexe\",\"executable\"],\"identifier\":\"6de8d1875ddb232e63e815caf4d89dc55b5ebcc41e997a48660ac59de0ab6eb6\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":28},\"behavioralIndicators\":{\"malicious\":5,\"suspicious\":8},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L20",null,{"initialData":{"schema_version":"1.0.15","sha256":"6de8d1875ddb232e63e815caf4d89dc55b5ebcc41e997a48660ac59de0ab6eb6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1790454715620,"unified_at":"2026-09-26T20:31:55.620Z","metadata":{"hashes":{"sha256":"6de8d1875ddb232e63e815caf4d89dc55b5ebcc41e997a48660ac59de0ab6eb6","sha1":"27e73322a9a34e0c2b88c700b88d92feace11ff6","md5":"2c5ce455ddf38e6c61aa60e1fd9b7350","sha512":"f4ffd5152f7309e1654ec740a88e88c567d8579ca7c74c2711ada36a6275b537ae38081294f198b6135d8d05a524ce932a0bf68e59900c253418e70ac1ec1c82","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"burnaware_pro_14.0_x64.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":15658368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1610711288000,"last_seen":1688856889000,"last_multi_scan":1688856889000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":["addrop","adposhel","adware","downloadassistant","dropper"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":23,"suspicious_count":8,"malicious_count":5,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$21","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/70 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.burnaware.com\"\n \"ocsp.sectigo.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"208.100.25.83:80\"\n \"208.100.25.83:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"burnaware_pro_14.0_x64.exe\" created file \"%TEMP%\\is-18BJF.tmp\\burnaware_pro_14.0_x64.tmp\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFF21A14B41D502907.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFB035E744ADECF707.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"IsoScope_d7c_IESQMMUTEX_0_519\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"IsoScope_d7c_ConnHashTable<3452>_HashTable_Mutex\"\n \"IsoScope_d7c_IESQMMUTEX_0_331\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"IsoScope_d7c_IE_EarlyTabStart_0xd84_Mutex\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3452\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"urlref_httpwww.burnaware.com\" as clean (type is \"HTML document ASCII text\")\n Antivirus vendors marked dropped file \"is-6C77E.tmp\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.burnaware.com\nDNT: 1\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00074304-00003452)\n Launches browser \"iexplore.exe\" (UID: 00074422-00003480)\n Launches browser \"iexplore.exe\" (UID: 00074471-00001148)\n Launches browser \"iexplore.exe\" (UID: 00074815-00003972)\n Launches browser \"iexplore.exe\" (UID: 00074817-00001200)\n Launches browser \"iexplore.exe\" (UID: 00074819-00003820)\n Launches browser \"iexplore.exe\" (UID: 00079090-00003108)\n Launches browser \"iexplore.exe\" (UID: 00079897-00002340)\n Launches browser \"iexplore.exe\" (UID: 00079919-00001896)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$22","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$23","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"BurnAware.exe\" searching for class \"BurnAware\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$24","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"C=RU, PostalCode=121614, L=Moscow, STREET=Krylatskie Kholmy 39-2, O=BurnAware, CN=BurnAware\" (SHA1: 59:63:9F:74:33:6E:97:9D:84:36:73:1C:92:EC:F0:AE:63:D5:D1:92: (1.2.840.113549.1.1.11); see report for more information)\n The input sample is signed with a certificate issued by \"C=GB, S=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Code Signing CA\" (SHA1: 94:C9:5D:A1:E8:50:BD:85:20:9A:4A:2A:F3:E1:FB:16:04:F9:BB:66: (1.2.840.113549.1.1.12); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, S=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority\" (SHA1: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E: (1.2.840.113549.1.1.12); see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"burnaware_pro_14.0_x64.exe\" connecting to \"\\ThemeApiPort\"\n \"burnaware_pro_14.0_x64.tmp\" connecting to \"\\ThemeApiPort\"\n \"BurnAware.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\" $\"Burnaware$ \" (Indicator: \"facebook.com\")\n \" $\"Burnaware$ \" (Indicator: \"twitter\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"BurnAware.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"burnaware_pro_14.0_x64.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"BurnAware.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/84 reputation engines marked \"http://crt.sectigo.com\" as malicious (2% detection rate)\n 1/76 reputation engines marked \"http://crl.sectigo.com/sectigorsacodesigningca.crl0s\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"info@burnaware.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"is-6C77E.tmp\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"is-VA4MS.tmp\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 208.100.25.83 on port 80 is sent without HTTP header\n TCP traffic to 208.100.25.83 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"BurnAware.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"balc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"burnaware_pro_14.0_x64.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"BurnAware.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"balc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/70 Antivirus vendors marked spawned process \"balc.exe\" (PID: 2976) as malicious (classified as \"malicious.b84525\" with 1% detection rate)\n 1/70 Antivirus vendors marked spawned process \"balc.exe\" (PID: 1308) as malicious (classified as \"malicious.b84525\" with 1% detection rate)\n 1/70 Antivirus vendors marked spawned process \"balc.exe\" (PID: 3932) as malicious (classified as \"malicious.b84525\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"BurnAware.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\BurnAware Professional\\balc.exe\" (Handle: 360)\n \"BurnAware.exe\" wrote 8 bytes to a remote process \"%PROGRAMFILES%\\BurnAware Professional\\balc.exe\" (Handle: 360)\n \"BurnAware.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\BurnAware Professional\\balc.exe\" (Handle: 360)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"burnaware_pro_14.0_x64.exe\" (UID: 00065029-00003304)\n Spawned process \"burnaware_pro_14.0_x64.tmp\" with commandline \"/SL5=\"$301A6\n15093744\n189952\nC:\\burnaware_pro_14.0_x64.exe\"\" (UID: 00065247-00002124)\n Spawned process \"BurnAware.exe\" (UID: 00074228-00001524)\n Spawned process \"BurnAware.exe\" (UID: 00074402-00003496)\n Spawned process \"BurnAware.exe\" (UID: 00074442-00001260)\n Spawned process \"balc.exe\" with commandline \"2\" (UID: 00074687-00002976)\n Spawned process \"balc.exe\" with commandline \"2\" (UID: 00074716-00001308)\n Spawned process \"balc.exe\" with commandline \"2\" (UID: 00074716-00003932)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}]},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":50,"imported_dlls_count":137,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":224,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":15,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":16,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["addrop","adposhel","adware","downloadassistant","dropper"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"600180f8b692ba5424353f73","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["USA"],"submit_name":"burnaware_pro_14.0_x64.exe","analysis_start_time":"2021-01-15T11:48:13+00:00","indicators_count":{"informative":23,"suspicious":13,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"208.100.25.83","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"address":"208.100.25.83","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}],"dns_resolutions":[{"domain":"ocsp.sectigo.com","address":"151.139.128.14","ttl":3576,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Sectigo Limited","registrar_name_servers":"NS1.AS48447.NET","registrar_creation_date":"2018-08-16T17:53:22+00:00","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"domain":"www.burnaware.com","address":"208.100.25.83","ttl":14399,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Burnaware","registrar_name_servers":"NS1.BURNAWARE.COM","registrar_creation_date":"2008-04-09T18:14:41+00:00","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}],"http_requests":[{"host":"www.burnaware.com","host_ip":"208.100.25.83:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.burnaware.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}],"processes":[{"pid":3304,"ppid":0,"name":"burnaware_pro_14.0_x64.exe","command_line":"","sha256":"6de8d1875ddb232e63e815caf4d89dc55b5ebcc41e997a48660ac59de0ab6eb6","normalized_path":"C:\\burnaware_pro_14.0_x64.exe","uid":"00065029-00003304","icon":"$2c"},{"pid":2124,"ppid":3304,"name":"burnaware_pro_14.0_x64.tmp","command_line":"/SL5=\"$301A6,15093744,189952,C:\\burnaware_pro_14.0_x64.exe\"","sha256":"14f53048003be484f0807ccd1c5f4aed93cec854ebbd6222d792c7a329204b56","normalized_path":"%TEMP%\\is-18BJF.tmp\\burnaware_pro_14.0_x64.tmp","parent_uid":"00065029-00003304","uid":"00065247-00002124"},{"pid":1524,"ppid":2124,"name":"BurnAware.exe","command_line":"","sha256":"6126469d98f12d1c2fa9c0680ae520fcd18847980fd4f56f19a85d3c2574d9e1","normalized_path":"%PROGRAMFILES%\\BurnAware Professional\\BurnAware.exe","parent_uid":"00065247-00002124","uid":"00074228-00001524"},{"pid":3932,"ppid":1524,"name":"balc.exe","command_line":"2","sha256":"3fb80fab5c21790d3617924a566473486b37060276a537ddbdf8df93ffd67556","normalized_path":"%PROGRAMFILES%\\BurnAware Professional\\balc.exe","parent_uid":"00074228-00001524","uid":"00074716-00003932"},{"pid":3452,"ppid":2124,"name":"iexplore.exe","command_line":"http://www.burnaware.com/","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00065247-00002124","uid":"00074304-00003452"},{"pid":1200,"ppid":3452,"name":"iexplore.exe","command_line":"SCODEF:3452 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00074304-00003452","uid":"00074817-00001200"},{"pid":2340,"ppid":3452,"name":"iexplore.exe","command_line":"SCODEF:3452 CREDAT:4142084 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00074304-00003452","uid":"00079897-00002340"},{"pid":3496,"ppid":2124,"name":"BurnAware.exe","command_line":"","sha256":"6126469d98f12d1c2fa9c0680ae520fcd18847980fd4f56f19a85d3c2574d9e1","normalized_path":"%PROGRAMFILES%\\BurnAware Professional\\BurnAware.exe","parent_uid":"00065247-00002124","uid":"00074402-00003496"},{"pid":1308,"ppid":3496,"name":"balc.exe","command_line":"2","sha256":"3fb80fab5c21790d3617924a566473486b37060276a537ddbdf8df93ffd67556","normalized_path":"%PROGRAMFILES%\\BurnAware Professional\\balc.exe","parent_uid":"00074402-00003496","uid":"00074716-00001308"},{"pid":3480,"ppid":2124,"name":"iexplore.exe","command_line":"http://www.burnaware.com/","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00065247-00002124","uid":"00074422-00003480"},{"pid":3972,"ppid":3480,"name":"iexplore.exe","command_line":"SCODEF:3480 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00074422-00003480","uid":"00074815-00003972"},{"pid":1896,"ppid":3480,"name":"iexplore.exe","command_line":"SCODEF:3480 CREDAT:4142082 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00074422-00003480","uid":"00079919-00001896"},{"pid":1260,"ppid":2124,"name":"BurnAware.exe","command_line":"","sha256":"6126469d98f12d1c2fa9c0680ae520fcd18847980fd4f56f19a85d3c2574d9e1","normalized_path":"%PROGRAMFILES%\\BurnAware Professional\\BurnAware.exe","parent_uid":"00065247-00002124","uid":"00074442-00001260"},{"pid":2976,"ppid":1260,"name":"balc.exe","command_line":"2","sha256":"3fb80fab5c21790d3617924a566473486b37060276a537ddbdf8df93ffd67556","normalized_path":"%PROGRAMFILES%\\BurnAware Professional\\balc.exe","parent_uid":"00074442-00001260","uid":"00074687-00002976"},{"pid":1148,"ppid":2124,"name":"iexplore.exe","command_line":"http://www.burnaware.com/","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00065247-00002124","uid":"00074471-00001148"},{"pid":3820,"ppid":1148,"name":"iexplore.exe","command_line":"SCODEF:1148 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00074471-00001148","uid":"00074819-00003820"},{"pid":3108,"ppid":1148,"name":"iexplore.exe","command_line":"SCODEF:1148 CREDAT:340994 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","parent_uid":"00074471-00001148","uid":"00079090-00003108"}],"all_imported_dlls":["wow64.dll","bcryptprimitives.dll","api-ms-win-downlevel-version-l1-1-0.dll","secur32.dll","npmproxy.dll","rasadhlp.dll","crypt32.dll","msvcr90.dll","KernelBase.dll","devrtl.dll","ieproxy.dll","wininet.dll","wship6.dll","d2d1.dll","shell32.dll","ieframe.dll","IEShims.dll","dhcpcsvc6.dll","ole32.dll","mpr.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","mscorwks.dll","sxs.dll","wow64cpu.dll","gpapi.dll","winhttp.dll","mscoree.dll","ntdll.dll","version.dll","sfc.dll","srvcli.dll","RpcRtRemote.dll","webio.dll","mscoreei.dll","kernel32.dll","msasn1.dll","ntshrui.dll","iertutil.dll","netprofm.dll","user32.dll","sspicli.dll","apphelp.dll","dui70.dll","profapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","rpcss.dll","FWPUCLNT.DLL","lpk.dll","cryptbase.dll","mlang.dll","imagehlp.dll","ssv.dll","MSOHEV.DLL","api-ms-win-downlevel-shlwapi-l2-1-0.dll","rpcrt4.dll","ws2_32.dll","urlmon.dll","comctl32.dll","bcrypt.dll","ExplorerFrame.dll","wtsapi32.dll","cryptnet.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","cfgmgr32.dll","devobj.dll","nsi.dll","dwmapi.dll","uxtheme.dll","oleaut32.dll","sechost.dll","msimg32.dll","imageres.dll","duser.dll","setupapi.dll","nlaapi.dll","wsock32.dll","mshtml.dll","RstrtMgr.dll","sfc_os.dll","mswsock.dll","rsaenh.dll","wkscli.dll","wshqos.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","winsta.dll","netapi32.dll","netutils.dll","WindowsCodecs.dll","comdlg32.dll","shfolder.dll","Wldap32.dll","credssp.dll","ieui.dll","msvcr100.dll","msftedit.dll","msvcrt.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","schannel.dll","oleaccrc.dll","slc.dll","clbcatq.dll","sqmapi.dll","SensApi.dll","jp2ssv.dll","advapi32.dll","ncrypt.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","shlwapi.dll","netmsg.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","oleacc.dll","ntmarta.dll","imm32.dll","userenv.dll","mscms.dll","msctf.dll","linkinfo.dll","dhcpcsvc.dll","wintrust.dll","normaliz.dll","deploy.dll","DWrite.dll","IPHLPAPI.DLL","WSHTCPIP.DLL","wow64win.dll","gdi32.dll","tiptsf.dll","winnsi.dll","cryptsp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","dxgi.dll","cscapi.dll","propsys.dll","VxSSL64.dll","dnsapi.dll","URLREDIR.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-6C77E.tmp","sha256":"9013634314497fbf9b6116acd966cbb9f58dd121ca64bd7a734dedb214d481e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"urlref_httpwww.burnaware.com","sha256":"d9b620f80bb9ad9d48d6777be5a29b7946d1d5ab03517bb2fb0cd72b3221dfe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"7ARVELD1.htm","sha256":"db7cf69be6c94d2c4b0894f27749a38dd265ea72f27884f2eddfe32fab9eaf4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"1IH46XJK.htm","sha256":"db7cf69be6c94d2c4b0894f27749a38dd265ea72f27884f2eddfe32fab9eaf4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"BurnAware Professional on the Web.url","sha256":"f00e15a8922d6bdecf8a113ea78818c33647d4bbdad83e924cfaebfa8da3a848","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Help.lnk","sha256":"78c823c179e06fb8c409c6310090e30a3d11cea28810adb63152ef6123acf2c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Uninstall BurnAware Professional.lnk","sha256":"82dbbe9c923e6036d6ea3cadaf24c148ef0c7bea07644b959d19cd0bc10355ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"burnaware.ini","sha256":"1eba0d073fb3db3e91fcf4f868b39466d7aab9c5921cea236e0dd82eb1a91933","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"M5BMR369.htm","sha256":"d9b620f80bb9ad9d48d6777be5a29b7946d1d5ab03517bb2fb0cd72b3221dfe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"XAOIVGZO.htm","sha256":"d9b620f80bb9ad9d48d6777be5a29b7946d1d5ab03517bb2fb0cd72b3221dfe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"PEAH53VN.htm","sha256":"d9b620f80bb9ad9d48d6777be5a29b7946d1d5ab03517bb2fb0cd72b3221dfe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"RPNEOO3P.htm","sha256":"db7cf69be6c94d2c4b0894f27749a38dd265ea72f27884f2eddfe32fab9eaf4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA","sha256":"f88cd2d6f01a12bf5de23c2a2fda9961312bcc73e4fb1ce7e5e3e40ab9abd928","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sha256":"b6a7767a0cac9579a5e310ca29fda65337be83bdca29426f2b8331c4cc534142","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691","sha256":"d53d8716607d8ca362e9615b607e5d135cef183da6102db3bb336941bcc1323c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sha256":"5105fbd7306e2bd000cb7d620ef9bc3e8bcce3d849fcef618a23e3ab59fd6321","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sha256":"6deb30cb2ba3100bbc09dba0e0666b36d077890b82534219ddbb8df66b23a162","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"is-21QDI.tmp","sha256":"815e57fa8f6279cd111e378ff37155dc8180c4ad46e35a6bd22ad845c17848c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"is-337E9.tmp","sha256":"cc8b62396416560e0f4002fbda6eb61a659526ed87cdf50b8faf9d75211c452d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"is-73BCA.tmp","sha256":"152d1106ac5c200ead5a61f795f8afc2fc8db7de72a91cc13eed3bf3ad0eef18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"is-98I9J.tmp","sha256":"adc067d2f7a3fd713ae81e5397756b6df2a22389d301f4d5212e0019f3b9c71e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"BurnAware Professional _64-bit_.lnk","sha256":"0adae2d0ef8f5beabc28d2fc9f992e61cb4a27a0116cd03c94c805d40539966d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}],"files_written":[{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\syswow64\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"C:\\burnaware_pro_14.0_x64.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bassalac.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bassenc_flac.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\VerifyDisc.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\DataDisc.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\DataRecovery.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\EraseDisc.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\SpanDisc.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bass_ape.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\basswv.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\BurnImage.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bass.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bassenc.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bassenc_ogg.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bassflac.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\badata_x64.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bamedia_x64.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bassenc_mp3.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\basswma.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\CopyDisc.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\CopyImage.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\AudioCD.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bass_ac3.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bassmix.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\DiscInfo.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\MakeISO.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\tags.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\MultiBurn.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\AudioGrabber.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bashell64.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bass_aac.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\bassenc_aac.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\MediaDisc.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\UnpackISO.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\is-18BJF.tmp\\burnaware_pro_14.0_x64.tmp","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\themes","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\BurnAware Professional","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\BurnAware.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\BurnAware Professional\\BurnAware Professional (64-bit).lnk","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\burnaware.chm","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\BurnAware Professional\\Help.lnk","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\BurnAware Professional\\BurnAware Professional on the Web.url","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\unins000.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\BurnAware Professional\\Uninstall BurnAware Professional.lnk","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_137095CCA1922136C4B9E18EE962B463","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\M5BMR369.htm","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\PEAH53VN.htm","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\XAOIVGZO.htm","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[9].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[10].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\faviconIHDLBUTV.png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\RPNEOO3P.htm","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\is-18BJF.tmp","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{6B8F575B-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DFF21A14B41D502907.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{6B8F575C-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DFB035E744ADECF707.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\faviconN9E0P2D8.png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{6B941C10-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DFE1A3FAEDCEB37F90.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon18O2PX39.png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\syswow64\\en\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{B6066592-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DFE1D8A9B7F05AFDE6.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~2\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\(x86)\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Burnaware","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Burnaware\\BurnAware","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\BurnAware Professional\\balc.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\en\\IEXPLORE.EXE.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DFBD877ECCC3B88EBD.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PUBLIC%\\Desktop\\BurnAware Professional (64-bit).lnk","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\YRECD7ZI.txt","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{F4EA9A38-571F-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{63E6F1C9-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DFD1E80EDDEBB86F08.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{F6339EBC-571F-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{F69A23DA-571F-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6CY2NG59.txt","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\24I82KXY.txt","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_8FB29C35032AE1827A2754ED35D7F2E8","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{63E6F1CA-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DFE6844809E9471EEA.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\favicon[4].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\faviconTTFLNOIH.png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\7ARVELD1.htm","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{AC3F006E-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DF0458AA4AED182376.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{AC3F006F-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DF06AF84CD60A1C126.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%APPDATA%\\Burnaware\\BurnAware\\burnaware.ini","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DF3E0B9936E832F028.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DF318A14085C1AB216.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_F4789A74F171F87D2A6760DE9B9F7537","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\572BF21E454637C9F000BE1AF9B1E1A9","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%WINDIR%\\SysWOW64\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_54F622E3E14833C841BD658EA54F7A65","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC42971B7939A9CA55C44CFC893D7C1D","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\VTO935KS\\1IH46XJK.htm","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{6B941C0F-5720-11EB-866C-08002793031A}.dat","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%TEMP%\\~DFA19CB89554D3FE63.TMP","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W4ZUP6XA\\favicon6AZJRXPQ.png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[9].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[4].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[10].png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon2YUM1J4D.png","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\favicon[5].ico","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SHELL EXTENSIONS\\CACHED\\","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4\\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\D1EB23A46D17D68FD92564C2F1F1601764D8E349\\D1EB23A46D17D68FD92564C2F1F1601764D8E349","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d7c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d7c_ConnHashTable<3452>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d7c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d7c_IE_EarlyTabStart_0xd84_Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3452","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d7c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d98_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d98_IE_EarlyTabStart_0xd70_Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d98_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d98_ConnHashTable<3480>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_d98_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3480","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_47c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_47c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_47c_IE_EarlyTabStart_0xd60_Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_1148","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_47c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"IsoScope_47c_ConnHashTable<1148>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3452","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d7c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_d98_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3480","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_47c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_1148","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_47c_IE_EarlyTabStart_0xd60_Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_47c_ConnHashTable<1148>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_47c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_47c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"600180f8b692ba5424353f73"}]}]}},"report_ids":{"sandbox_job_ids":["600180f8b692ba5424353f73"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Sample 6de8d1875ddb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 6de8d1875ddb…. Threat score 0/100. 0/28 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6de8d1875ddb232e63e815caf4d89dc55b5ebcc41e997a48660ac59de0ab6eb6"}],["$","meta","4",{"property":"og:title","content":"Sample 6de8d1875ddb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 6de8d1875ddb…. Threat score 0/100. 0/28 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6de8d1875ddb232e63e815caf4d89dc55b5ebcc41e997a48660ac59de0ab6eb6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 6de8d1875ddb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 6de8d1875ddb…. Threat score 0/100. 0/28 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]