24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious App/DiskGen Sample 6ed944b35637… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6ed944b35637…. Malware family: App/DiskGen. Threat score 100/100. 1/26 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12","keywords":["Malicious","App/DiskGen","malware analysis","sandbox report","threat intelligence","6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12"],"about":{"@type":"SoftwareApplication","name":"DGEngSetup5431342.exe","applicationCategory":["peexe","executable"],"identifier":"6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"App/DiskGen","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":10,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T432,"DGEngSetup5431342.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "USESHORTNAME") "DGEngSetup5431342.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "DGEngSetup5431342.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "DGEngSetup5431342.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "PATH") "DGEngSetup5431342.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "APPENDPATH") "DGEngSetup5431342.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{2661F2FA-56A7-415D-8196-C4CB3D3ACFFE}_IS1") "DGEngSetup5431342.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\DGENGSETUP5431342.TMP") "DGEngSetup5431342.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\DGENGSETUP5431342.TMP") "DGEngSetup5431342.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{FC4FF5F4-2265-4E18-8BBC-12CBA9794388}_IS1")26:T6da,"DiskGenius.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")27:T7ef,"DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CTLS"; Key: "") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "DiskGenius.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "DiskGenius.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\2A83E9020591A55FC6DDAD3FB102794C52B24E70"; Key: "BLOB")28:T681,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Cache-Control: max-age = 86400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGYpOxyatdouCgAAAAE7fWo%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECic8o4O65s0CgAAAAE7fWk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECT3LgFtm%2Bx0CgAAAAE7gBc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog"29:Tc70,"DGEngSetup5431342.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "DGEngSetup5431342.tmp" touched "Property System Both Class Factory" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "DGEngSetup5431342.tmp" touched "Application Registration" (Path: "HKCU\WOW6432NODE\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Network" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "DGEngSetup5431342.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "DGEngSetup5431342.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "DGEngSetup5431342.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\WOW6432NODE\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\WOW6432NODE\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INPROCSERVER32") "DGEngSetup5431342.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "DGEngSetup5431342.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "DGEngSetup5431342.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\INPROCSERVER32") "DiskGenius.exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "DiskGenius.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "DiskGenius.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\PROGID")2a:T857,"DiskGenius.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Sun Apr 10 20:23:17 2022 mtime=Sun Apr 10 20:23:17 2022 atime=Thu Apr 7 07:48:34 2022 length=33156448 window=hide" "urlblockindex_1_.bin" has type "data" "Uninstall DiskGenius.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Sun Apr 10 20:23:17 2022 mtime=Sun Apr 10 20:23:17 2022 atime=Sun Apr 10 20:21:25 2022 length=2579808 window=hide" "Run DiskGenius.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Archive ctime=Sun Apr 10 20:23:17 2022 mtime=Sun Apr 10 20:23:17 2022 atime=Thu Apr 7 07:48:34 2022 length=33156448 window=hide" "urlref_httpswww.diskgenius.com" has type "HTML document UTF-8 Unicode text" "idx_banner_1_.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 progressive precision 8 1920x757 frames 3" "partition-management-108-100_1_.png" has type "PNG image data 108 x 100 8-bit colormap non-interlaced" "5DQ0BCLM.htm" has type "HTML document UTF-8 Unicode text" "idx_22_1_.png" has type "PNG image data 1920 x 640 2-bit colormap non-interlaced" "idx-clients_1_.png" has type "PNG image data 960 x 128 8-bit colormap non-interlaced" "idx_16_1_.png" has type "PNG image data 560 x 440 8-bit colormap non-interlaced" "is-T2DL8.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data" "is-N9QIK.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "unins000.dat" has type "data" "_A7ADF4A9-B90C-11EC-9844-08002754227E_.dat" has type "Composite Document File V2 Document Cannot read section info" "is-17QA1.tmp" has type "FREE-DOS executable (COM) UPX compressed" "ft_bg_1_.png" has type "PNG image data 1920 x 280 1-bit colormap non-interlaced" "F2DDCD2B5F37625B82E81F4976CEE400_0E9C76115DBFA86C8F9457BCE000B4BF" has type "data"2b:T494,"DGEngSetup5431342.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "DGEngSetup5431342.exe" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "DGEngSetup5431342.tmp" touched file "C:\Windows\syswow64\en\KERNELBASE.dll.mui" "DGEngSetup5431342.tmp" touched file "C:\Windows\syswow64\en\SHELL32.dll.mui" "DGEngSetup5431342.tmp" touched file "C:\Windows\AppPatch\sysmain.sdb" "DGEngSetup5431342.tmp" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "DGEngSetup5431342.tmp" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\Uninstall DiskGenius.lnk" "iexplore.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\PrivacIE" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\DNTException"2c:T910,"DGEngSetup5431342.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-OOH4B.tmp\DGEngSetup5431342.tmp" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\Run DiskGenius.lnk" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\Run DiskGenius.pif" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\Run DiskGenius.url" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\DiskGenius on the Web.lnk" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\DiskGenius on the Web.pif" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\DiskGenius on the Web.url" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\Uninstall DiskGenius.lnk" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\Uninstall DiskGenius.pif" with delete access "DGEngSetup5431342.tmp" opened "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiskGenius\Uninstall DiskGenius.url" with delete access "DGEngSetup5431342.tmp" opened "C:\Users\Public\Desktop\DiskGenius.lnk" with delete access "DGEngSetup5431342.tmp" opened "C:\Users\Public\Desktop\DiskGenius.pif" with delete access "DGEngSetup5431342.tmp" opened "C:\Users\Public\Desktop\DiskGenius.url" with delete access "DGEngSetup5431342.tmp" opened "C:\Program Files\DiskGenius\is-ECIIK.tmp" with delete access "DGEngSetup5431342.tmp" opened "C:\Program Files\DiskGenius\is-ROB9A.tmp" with delete access "DGEngSetup5431342.tmp" opened "C:\Program Files\DiskGenius\is-VD9VL.tmp" with delete access "DGEngSetup5431342.tmp" opened "C:\Program Files\DiskGenius\is-T2DL8.tmp" with delete access "DGEngSetup5431342.tmp" opened "C:\Program Files\DiskGenius\is-R0MBN.tmp" with delete access "DGEngSetup5431342.tmp" opened "C:\Program Files\DiskGenius\is-F6KL7.tmp" with delete access "DGEngSetup5431342.tmp" opened "C:\Program Files\DiskGenius\is-13RO1.tmp" with delete access2d:T7cc,"DiskGenius.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CERTIFICATES") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUST\CRLS") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "DiskGenius.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")2e:Ta45,"DGEngSetup5431342.exe" wrote bytes "c0df8f771cf98e77ccf88e770d64907700000000c0118e7500000000fc3e8e7500000000e0138e750000000094574f7625e08f77c6e08f7700000000bc6a4e7600000000cf318e750000000093194f76000000002c328e7500000000" to virtual address "0x76161000" (part of module "NSI.DLL") "DGEngSetup5431342.exe" wrote bytes "711176017a3b7501ab8b02007f950200fc8c0200729602006cc805001ecd72017d267201" to virtual address "0x761F07E4" (part of module "USER32.DLL") "DGEngSetup5431342.tmp" wrote bytes "c0df8f771cf98e77ccf88e770d64907700000000c0118e7500000000fc3e8e7500000000e0138e750000000094574f7625e08f77c6e08f7700000000bc6a4e7600000000cf318e750000000093194f76000000002c328e7500000000" to virtual address "0x76161000" (part of module "NSI.DLL") "DGEngSetup5431342.tmp" wrote bytes "711176017a3b7501ab8b02007f950200fc8c0200729602006cc805001ecd72017d267201" to virtual address "0x761F07E4" (part of module "USER32.DLL") "DGEngSetup5431342.tmp" wrote bytes "cb5d4ea2" to virtual address "0x72CCB8E0" (part of module "IMAGERES.DLL") "iexplore.exe" wrote bytes "d04fccf2fe070000f01d593f01000000101e593f01000000e036593f01000000501e593f010000000000000000000000" to virtual address "0x3F598000" "IEXPLORE.EXE" wrote bytes "b0339e73" to virtual address "0x75CD17CC" (part of module "ADVAPI32.DLL") "IEXPLORE.EXE" wrote bytes "a0479e73" to virtual address "0x75879274" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "c0df8f771cf98e77ccf88e770d64907700000000c0118e7500000000fc3e8e7500000000e0138e750000000094574f7625e08f77c6e08f7700000000bc6a4e7600000000cf318e750000000093194f76000000002c328e7500000000" to virtual address "0x76161000" (part of module "NSI.DLL") "IEXPLORE.EXE" wrote bytes "80321900703219000032190060321900503219004032190030321900000000002cc96376c021190000000000901719005023190000181900601f190020361900000000004036190000000000" to virtual address "0x00198000" "IEXPLORE.EXE" wrote bytes "b0339e73" to virtual address "0x001970C0" "IEXPLORE.EXE" wrote bytes "711176017a3b7501ab8b02007f950200fc8c0200729602006cc805001ecd72017d267201" to virtual address "0x761F07E4" (part of module "USER32.DLL") "IEXPLORE.EXE" wrote bytes "b0339e73" to virtual address "0x7587917C" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "f0319e73" to virtual address "0x7587B0BC" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "a0359e73" to virtual address "0x7587B0CC" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "80499e73" to virtual address "0x758792E8" (part of module "IERTUTIL.DLL") "IEXPLORE.EXE" wrote bytes "70489e73" to virtual address "0x7587B0C8" (part of module "IERTUTIL.DLL")2f:T699,"DGEngSetup5431342.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "DGEngSetup5431342.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "DGEngSetup5431342.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "DGEngSetup5431342.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "IS") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IS") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "NL") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "DGEngSetup5431342.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP")30:Te36,"DGEngSetup5431342.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-OOH4B.tmp\DGEngSetup5431342.tmp" (Handle: 256) "DGEngSetup5431342.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-OOH4B.tmp\DGEngSetup5431342.tmp" (Handle: 256) "DGEngSetup5431342.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-OOH4B.tmp\DGEngSetup5431342.tmp" (Handle: 256) "DGEngSetup5431342.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-OOH4B.tmp\DGEngSetup5431342.tmp" (Handle: 256) "DGEngSetup5431342.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-OOH4B.tmp\DGEngSetup5431342.tmp" (Handle: 256) "DGEngSetup5431342.tmp" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 964) "DGEngSetup5431342.tmp" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 964) "DGEngSetup5431342.tmp" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 964) "DGEngSetup5431342.tmp" wrote 8 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 964) "DGEngSetup5431342.tmp" wrote 8 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 968) "DGEngSetup5431342.tmp" wrote 32 bytes to a remote process "C:\Program Files\DiskGenius\DiskGenius.exe" (Handle: 776) "DGEngSetup5431342.tmp" wrote 52 bytes to a remote process "C:\Program Files\DiskGenius\DiskGenius.exe" (Handle: 776) "DGEngSetup5431342.tmp" wrote 4 bytes to a remote process "C:\Program Files\DiskGenius\DiskGenius.exe" (Handle: 776) "DGEngSetup5431342.tmp" wrote 8 bytes to a remote process "C:\Program Files\DiskGenius\DiskGenius.exe" (Handle: 776) "DGEngSetup5431342.tmp" wrote 32 bytes to a remote process "C:\Program Files\DiskGenius\DiskGenius.exe" (Handle: 836) "DGEngSetup5431342.tmp" wrote 52 bytes to a remote process "C:\Program Files\DiskGenius\DiskGenius.exe" (Handle: 836) "DGEngSetup5431342.tmp" wrote 4 bytes to a remote process "C:\Program Files\DiskGenius\DiskGenius.exe" (Handle: 836) "DGEngSetup5431342.tmp" wrote 8 bytes to a remote process "C:\Program Files\DiskGenius\DiskGenius.exe" (Handle: 836) "DGEngSetup5431342.tmp" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 968) "DGEngSetup5431342.tmp" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 968) "DGEngSetup5431342.tmp" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 968) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 884) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 884) "iexplore.exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 884) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 884) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 872) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 872) "iexplore.exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 872) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Internet Explorer\iexplore.exe" (Handle: 872)31:Tcba,Found malicious artifacts related to "47.246.24.229": ... URL: http://alissl.ucdl.pp.uc.cn/fs08/2016/12/28/2/ (AV positives: 5/93 scanned on 04/10/2022 22:25:16) URL: http://ucdl.25pp.com/ppandroid/lztools/lizi_modifier.apk (AV positives: 4/93 scanned on 04/10/2022 16:06:14) URL: http://alissl.ucdl.pp.uc.cn/fs01/2015/01/31/4/112_1cb74eba14f00cc48cad16528fcc9176.apk (AV positives: 5/93 scanned on 04/10/2022 16:01:30) URL: http://alissl.ucdl.pp.uc.cn/fs04/2015/08/06/5/ (AV positives: 6/93 scanned on 04/10/2022 10:54:54) URL: http://alissl.ucdl.pp.uc.cn/fs08/2016/05/27/11/ (AV positives: 5/93 scanned on 04/10/2022 09:54:48) File SHA256: a67a0a08b77e24f47cc98e8256724611c1904a242f80fcaa1a8e15596bca6870 (AV positives: 1/72 scanned on 04/07/2022 14:01:31) File SHA256: 7921a6035cc8a0981a5dee737dd3d29b150ddd48407717d3fca4b6376f2b0e70 (AV positives: 1/73 scanned on 04/07/2022 00:53:49) File SHA256: 01bdd6ee60327dc3e18a0ecce5be65682fd812e3e325b32e5f92df3ee7555558 (AV positives: 1/73 scanned on 04/02/2022 16:10:55) File SHA256: 241b51301f74fa24f255aad1fd4b4356fb228ee2984adaa8b08995fa43804dd0 (AV positives: 25/73 scanned on 04/01/2022 02:32:54) File SHA256: 594697ca0498ee8911ac15e7382bf834aafd2c3dd1af0c40c5174de052e9808f (AV positives: 18/73 scanned on 04/01/2022 02:04:29) Found malicious artifacts related to "47.246.24.228": ... URL: http://dl.97973.com/97973YXKUD/androidKUD/2048.apk (AV positives: 4/93 scanned on 04/10/2022 16:15:09) URL: http://b4.market.mi-img.com/download/appchannel/08de14b3166898f5cf22f0b743b74503d9b432ca9/com.mofplay.mili.qslxx.mi.apk (AV positives: 2/93 scanned on 04/10/2022 16:05:23) URL: http://ucdl.25pp.com/fs01/2014/09/28/0_0bff0a51972d5896c5c5df702c1fa58e.apk (AV positives: 2/93 scanned on 04/10/2022 16:02:03) URL: http://b8.market.mi-img.com/download/AppStore/00b054f655ae9b35d6fb3c5f69300a68e2242dec4/ (AV positives: 2/93 scanned on 04/10/2022 12:54:53) URL: http://b6.market.xiaomi.com/download/AppStore/03cfe44b9d064d5f6bdca234e6af7cf0b86406d28/ (AV positives: 1/93 scanned on 04/10/2022 11:55:54) File SHA256: 4422df80679de4c3a27a07c02f4965098140086fcdd8bbc1e53c6b602b991593 (AV positives: 1/73 scanned on 04/06/2022 09:33:52) File SHA256: 241b51301f74fa24f255aad1fd4b4356fb228ee2984adaa8b08995fa43804dd0 (AV positives: 25/73 scanned on 04/01/2022 02:32:54) File SHA256: 594697ca0498ee8911ac15e7382bf834aafd2c3dd1af0c40c5174de052e9808f (AV positives: 18/73 scanned on 04/01/2022 02:04:29) File SHA256: a07f3ffc83598acdbc68e85aaa68831f390b48157a56614c753dfca485639cb7 (AV positives: 1/73 scanned on 03/30/2022 20:35:56) File SHA256: 7921a6035cc8a0981a5dee737dd3d29b150ddd48407717d3fca4b6376f2b0e70 (AV positives: 1/73 scanned on 03/27/2022 02:46:45) File SHA256: 69c78496ff19b5d94d1ea2acafb2c433a867bb0866e2690df2fa023321e36c36 (Date: 03/10/2022 20:10:28) File SHA256: 18a03e5775a96e192c7d90b747d3f124601f64b3cfcdd149181dda945dc3b46d (Date: 06/15/2021 12:21:53) File SHA256: 07891c892942740735cec8db804673cfd16a103811cf027f9d4e4c9681d3f9b2 (Date: 04/23/2021 22:01:54) File SHA256: 1ef2eae03b6a3ecc2762c2a74f478cee595efccafa9af21753263502b90097ee (Date: 04/09/2021 20:27:28) File SHA256: 11b60fe865707731fc0e2ee8a2f7b78af47df8e3f8f83b0bbb2dccd9ea4bf786 (Date: 04/04/2021 05:39:05)32:Tcba,Found malicious artifacts related to "47.246.24.229": ... URL: http://alissl.ucdl.pp.uc.cn/fs08/2016/12/28/2/ (AV positives: 5/93 scanned on 04/10/2022 22:25:16) URL: http://ucdl.25pp.com/ppandroid/lztools/lizi_modifier.apk (AV positives: 4/93 scanned on 04/10/2022 16:06:14) URL: http://alissl.ucdl.pp.uc.cn/fs01/2015/01/31/4/112_1cb74eba14f00cc48cad16528fcc9176.apk (AV positives: 5/93 scanned on 04/10/2022 16:01:30) URL: http://alissl.ucdl.pp.uc.cn/fs04/2015/08/06/5/ (AV positives: 6/93 scanned on 04/10/2022 10:54:54) URL: http://alissl.ucdl.pp.uc.cn/fs08/2016/05/27/11/ (AV positives: 5/93 scanned on 04/10/2022 09:54:48) File SHA256: a67a0a08b77e24f47cc98e8256724611c1904a242f80fcaa1a8e15596bca6870 (AV positives: 1/72 scanned on 04/07/2022 14:01:31) File SHA256: 7921a6035cc8a0981a5dee737dd3d29b150ddd48407717d3fca4b6376f2b0e70 (AV positives: 1/73 scanned on 04/07/2022 00:53:49) File SHA256: 01bdd6ee60327dc3e18a0ecce5be65682fd812e3e325b32e5f92df3ee7555558 (AV positives: 1/73 scanned on 04/02/2022 16:10:55) File SHA256: 241b51301f74fa24f255aad1fd4b4356fb228ee2984adaa8b08995fa43804dd0 (AV positives: 25/73 scanned on 04/01/2022 02:32:54) File SHA256: 594697ca0498ee8911ac15e7382bf834aafd2c3dd1af0c40c5174de052e9808f (AV positives: 18/73 scanned on 04/01/2022 02:04:29) Found malicious artifacts related to "47.246.24.228": ... URL: http://dl.97973.com/97973YXKUD/androidKUD/2048.apk (AV positives: 4/93 scanned on 04/10/2022 16:15:09) URL: http://b4.market.mi-img.com/download/appchannel/08de14b3166898f5cf22f0b743b74503d9b432ca9/com.mofplay.mili.qslxx.mi.apk (AV positives: 2/93 scanned on 04/10/2022 16:05:23) URL: http://ucdl.25pp.com/fs01/2014/09/28/0_0bff0a51972d5896c5c5df702c1fa58e.apk (AV positives: 2/93 scanned on 04/10/2022 16:02:03) URL: http://b8.market.mi-img.com/download/AppStore/00b054f655ae9b35d6fb3c5f69300a68e2242dec4/ (AV positives: 2/93 scanned on 04/10/2022 12:54:53) URL: http://b6.market.xiaomi.com/download/AppStore/03cfe44b9d064d5f6bdca234e6af7cf0b86406d28/ (AV positives: 1/93 scanned on 04/10/2022 11:55:54) File SHA256: 4422df80679de4c3a27a07c02f4965098140086fcdd8bbc1e53c6b602b991593 (AV positives: 1/73 scanned on 04/06/2022 09:33:52) File SHA256: 241b51301f74fa24f255aad1fd4b4356fb228ee2984adaa8b08995fa43804dd0 (AV positives: 25/73 scanned on 04/01/2022 02:32:54) File SHA256: 594697ca0498ee8911ac15e7382bf834aafd2c3dd1af0c40c5174de052e9808f (AV positives: 18/73 scanned on 04/01/2022 02:04:29) File SHA256: a07f3ffc83598acdbc68e85aaa68831f390b48157a56614c753dfca485639cb7 (AV positives: 1/73 scanned on 03/30/2022 20:35:56) File SHA256: 7921a6035cc8a0981a5dee737dd3d29b150ddd48407717d3fca4b6376f2b0e70 (AV positives: 1/73 scanned on 03/27/2022 02:46:45) File SHA256: 69c78496ff19b5d94d1ea2acafb2c433a867bb0866e2690df2fa023321e36c36 (Date: 03/10/2022 20:10:28) File SHA256: 18a03e5775a96e192c7d90b747d3f124601f64b3cfcdd149181dda945dc3b46d (Date: 06/15/2021 12:21:53) File SHA256: 07891c892942740735cec8db804673cfd16a103811cf027f9d4e4c9681d3f9b2 (Date: 04/23/2021 22:01:54) File SHA256: 1ef2eae03b6a3ecc2762c2a74f478cee595efccafa9af21753263502b90097ee (Date: 04/09/2021 20:27:28) File SHA256: 11b60fe865707731fc0e2ee8a2f7b78af47df8e3f8f83b0bbb2dccd9ea4bf786 (Date: 04/04/2021 05:39:05)33:T417,"iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")34:T63c,"is-GPHFU.tmp" contains export function called "SDL_AddEventWatch" at ordinal 1 "is-GPHFU.tmp" contains export function called "SDL_AddHintCallback" at ordinal 2 "is-GPHFU.tmp" contains export function called "SDL_AddTimer" at ordinal 3 "is-GPHFU.tmp" contains export function called "SDL_AllocFormat" at ordinal 4 "is-GPHFU.tmp" contains export function called "SDL_AllocPalette" at ordinal 5 "is-GPHFU.tmp" contains export function called "SDL_AllocRW" at ordinal 6 "is-GPHFU.tmp" contains export function called "SDL_AtomicAdd" at ordinal 7 "is-GPHFU.tmp" contains export function called "SDL_AtomicCAS" at ordinal 8 "is-GPHFU.tmp" contains export function called "SDL_AtomicCASPtr" at ordinal 9 "is-GPHFU.tmp" contains export function called "SDL_AtomicGet" at ordinal 10 "is-GPHFU.tmp" contains export function called "SDL_AtomicGetPtr" at ordinal 11 "is-GPHFU.tmp" contains export function called "SDL_AtomicLock" at ordinal 12 "is-GPHFU.tmp" contains export function called "SDL_AtomicSet" at ordinal 13 "is-GPHFU.tmp" contains export function called "SDL_AtomicSetPtr" at ordinal 14 "is-GPHFU.tmp" contains export function called "SDL_AtomicTryLock" at ordinal 15 "is-GPHFU.tmp" contains export function called "SDL_AtomicUnlock" at ordinal 16 "is-GPHFU.tmp" contains export function called "SDL_AudioInit" at ordinal 17 "is-GPHFU.tmp" contains export function called "SDL_AudioQuit" at ordinal 18 "is-GPHFU.tmp" contains export function called "SDL_AudioStreamAvailable" at ordinal 19 "is-GPHFU.tmp" contains export function called "SDL_AudioStreamClear" at ordinal 2035:T9b4,"GetLongPathNameW" (Indicator: "GetLongPathNameW") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "ResetEvent" (Indicator: "ResetEvent") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "FHeapSize" (Indicator: "HeapSize") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "VariantChangeTypeEx" (Indicator: "VariantChangeType") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "GetSystemTimes" (Indicator: "GetSystemTime") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "GetTickCount" (Indicator: "GetTickCount") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "GetParentComponent" (Indicator: "GetParent") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "RegisterClassAlias" (Indicator: "RegisterClassA") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "LocalFree" (Indicator: "LocalFree") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "CloseHandle" (Indicator: "CloseHandle") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "SizeofResource" (Indicator: "SizeofResource") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "VirtualProtect" (Indicator: "VirtualProtect") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "VirtualFree" (Indicator: "VirtualFree") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "ExitProcess" (Indicator: "ExitProcess") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "HeapAlloc" (Indicator: "HeapAlloc") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "GetCPInfoExW" (Indicator: "GetCPInfo") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "RtlUnwind" (Indicator: "RtlUnwind") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "GetCPInfo" (Indicator: "GetCPInfo") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "GetStdHandle" (Indicator: "GetStdHandle") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin "GetModuleHandleW" (Indicator: "GetModuleHandleW") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin36:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790474794149,"unified_at":"2026-09-27T02:06:34.149Z","metadata":{"hashes":{"sha256":"6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12","sha1":"ffb05ae7f2896d32a33e01af92b7fde67772a253","md5":"a7ce2445a928bdc7abb280335bd7fb0d","sha512":"23da172ec1643ca466e290054e131c94c24cd19a4b14215aeeb50ddabb1bfe1ab140e70d991ac9f5afd25b22e693b4b4d425e1cd1eece44f1060ec64feaedd51","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"DGEngSetup5431342.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":81586032,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1649627917000,"last_seen":1763600751000,"last_multi_scan":1763600751000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["kryptik","stealer","evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":23},"sandbox_signatures":{"informative_count":44,"suspicious_count":19,"malicious_count":10,"total":73},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/DiskGen-Ins","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"App/DiskGen","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Bootkit","attack_id":"T1542.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1542/003","identifiers":[{"type":"malicious","value":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Observed AdjustTokenPrivileges API string"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Checks for a resource fork (ADS) file"},{"type":"malicious","value":"Creates a resource fork (ADS) file (often used to hide data)"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Observed GetNativeSystemInfo API string"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries disc information (often used to evade virtual machines)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Found decrypted SSL traffic"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Observed strings related to Windows privileges"}],"sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"DGEngSetup5431342.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DGEngSetup5431342.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"DGEngSetup5431342.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DGEngSetup5431342.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"DiskGenius.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"IEXPLORE.EXE\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"DGEngSetup5431342.tmp\" queries volume information of \"C:\\share\" at 00000000-00003364-00000046-12169639\n \"DGEngSetup5431342.tmp\" queries volume information of \"C:\\\" at 00000000-00003364-00000046-72097962\n \"DGEngSetup5431342.tmp\" queries volume information of \"%PROGRAMFILES%\\DiskGenius\\DiskGenius.exe\" at 00000000-00003364-00000046-72123506\n \"DGEngSetup5431342.tmp\" queries volume information of \"C:\\\" at 00000000-00003364-00000046-72894511\n \"DGEngSetup5431342.tmp\" queries volume information of \"%PROGRAMFILES%\\DiskGenius\\unins000.exe\" at 00000000-00003364-00000046-72895561\n \"DGEngSetup5431342.tmp\" queries volume information of \"C:\\\" at 00000000-00003364-00000046-73006783\n \"DGEngSetup5431342.tmp\" queries volume information of \"%PROGRAMFILES%\\DiskGenius\\DiskGenius.exe\" at 00000000-00003364-00000046-73007829","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"DGEngSetup5431342.tmp\" queries volume information of \"C:\\\" at 00000000-00003364-00000046-72097962\n \"DGEngSetup5431342.tmp\" queries volume information of \"C:\\\" at 00000000-00003364-00000046-72894511\n \"DGEngSetup5431342.tmp\" queries volume information of \"C:\\\" at 00000000-00003364-00000046-73006783","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"SURICATA STREAM excessive retransmissions\" (SID: 2210054, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.pki.goog\"\n \"crl.pki.goog\"\n \"crls.pki.goog\"\n \"internal.eassos.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"47.246.24.229:443\"\n \"142.250.191.168:443\"\n \"47.246.24.228:443\"\n \"142.251.32.3:80\"\n \"172.217.2.46:80\"\n \"142.250.190.46:443\"\n \"142.251.4.157:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cc8_IESQMMUTEX_0_519\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3272\"\n \"IsoScope_cc8_IESQMMUTEX_0_519\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"IsoScope_cc8_IE_EarlyTabStart_0xe50_Mutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"Local\\ZonesCacheCounterMutex\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"is-T2DL8.tmp\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"is-N9QIK.tmp\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"is-17QA1.tmp\" as clean (type is \"FREE-DOS executable (COM) UPX compressed\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00003272)\n Launches browser \"iexplore.exe\" (UID: 00000000-00000796)\n Launches browser \"IEXPLORE.EXE\" (UID: 00000000-00004020)\n Launches browser \"IEXPLORE.EXE\" (UID: 00000000-00002972)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Observed AdjustTokenPrivileges API string","description":"\"AdjustTokenPrivileges\" observed string \"provides the ability to enable or disable privileges in the specified access token\" (Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin\"","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Observed GetNativeSystemInfo API string","description":"\"GetNativeSystemInfo\" observed string \"provides the ability to retrieves information about the current system\" (Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$29","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"DGEngSetup5431342.tmp\" (UID: 00000000-00003364) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"DGEngSetup5431342.tmp\" (UID: 00000000-00003364) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"iexplore.exe\" (UID: 00000000-00003272) was launched with modified environment variables: \"Path\"\n Process \"DiskGenius.exe\" (UID: 00000000-00001320) was launched with modified environment variables: \"Path\"\n Process \"iexplore.exe\" (UID: 00000000-00000796) was launched with modified environment variables: \"Path\"\n Process \"IEXPLORE.EXE\" (UID: 00000000-00004020) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"IEXPLORE.EXE\" (UID: 00000000-00004020) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"IEXPLORE.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"References url in command line","description":"Process \"iexplore.exe\" with commandline \"https://www.diskgenius.com/\" (UID: 00000000-00003272)\n Process \"iexplore.exe\" with commandline \"https://www.diskgenius.com/\" (UID: 00000000-00000796)","origin":"Monitored Target","id":"target-174","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"DGEngSetup5431342.tmp\" searching for class \"Shell_TrayWnd\"\n \"DGEngSetup5431342.tmp\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"DGEngSetup5431342.tmp\" with commandline \"/SL5=\"$301C0\n80722465\n780800\nC:\\DGEngSetup5431342.exe\"\" (UID: 00000000-00003364)\n Spawned process \"DiskGenius.exe\" (UID: 00000000-00001256)\n Spawned process \"iexplore.exe\" with commandline \"https://www.diskgenius.com/\" (UID: 00000000-00003272)\n Spawned process \"DiskGenius.exe\" (UID: 00000000-00001320)\n Spawned process \"iexplore.exe\" with commandline \"https://www.diskgenius.com/\" (UID: 00000000-00000796)\n Spawned process \"IEXPLORE.EXE\" with commandline \"SCODEF:3272 CREDAT:275457 /prefetch:2\" (UID: 00000000-00004020)\n Spawned process \"IEXPLORE.EXE\" with commandline \"SCODEF:796 CREDAT:275457 /prefetch:2\" (UID: 00000000-00002972)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"DGEngSetup5431342.tmp\" with commandline \"/SL5=\"$301C0\n80722465\n780800\nC:\\DGEngSetup5431342.exe\"\" (UID: 00000000-00003364)\n Spawned process \"DiskGenius.exe\" (UID: 00000000-00001256)\n Spawned process \"iexplore.exe\" with commandline \"https://www.diskgenius.com/\" (UID: 00000000-00003272)\n Spawned process \"DiskGenius.exe\" (UID: 00000000-00001320)\n Spawned process \"iexplore.exe\" with commandline \"https://www.diskgenius.com/\" (UID: 00000000-00000796)\n Spawned process \"IEXPLORE.EXE\" with commandline \"SCODEF:3272 CREDAT:275457 /prefetch:2\" (UID: 00000000-00004020)\n Spawned process \"IEXPLORE.EXE\" with commandline \"SCODEF:796 CREDAT:275457 /prefetch:2\" (UID: 00000000-00002972)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"OID.1.3.6.1.4.1.311.60.2.1.3=CN, OID.1.3.6.1.4.1.311.60.2.1.2=???, OID.1.3.6.1.4.1.311.60.2.1.1=???, OID.2.5.4.15=Private Organization, SERIALNUMBER=91130302MA09JH3X4Y, C=CN, S=???, L=????, O=\"Qinhuangdao Yizhishu Software Development Co.\n Ltd.\", OU=IT, CN=\"Qinhuangdao Yizhishu Software Development Co.\n Ltd.\"\" (SHA1: 70:93:EC:E1:38:78:48:7E:60:20:24:5D:7C:39:C0:E2:77:85:5C:D4: (1.2.840.113549.1.1.11); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA SHA2\" (SHA1: 60:EE:3F:C5:3D:4B:DF:D1:69:7A:E5:BE:AE:1C:AB:1C:0F:3A:D4:E3: (1.2.840.113549.1.1.11); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA\" (SHA1: 5F:B7:EE:06:33:E2:59:DB:AD:0C:4C:9A:E6:D3:8F:1A:61:C7:DC:25: (sha1RSA(RSA)); see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"DGEngSetup5431342.exe\" connecting to \"\\ThemeApiPort\"\n \"DGEngSetup5431342.tmp\" connecting to \"\\ThemeApiPort\"\n \"DiskGenius.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2a","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://jrsoftware.org/ishelp/index.php?topic=setupcmdline\"\n Heuristic match: \"internal.eassos.com\"\n Pattern match: \"https://www.diskgenius.com/\"\n Pattern match: \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\"\n Pattern match: \"http://www.w3.org/1999/xhtml\"\n Pattern match: \"https://www.googletagmanager.com/gtag/js?id=UA-21372649-5\"\n Pattern match: \"http://schema.org\"\n Pattern match: \"https://www.diskgenius.com/public/images/dg-logo.png\"\n Pattern match: \"https://www.eassos.com/public/images/eassosLogo.png\"\n Pattern match: \"https://www.facebook.com/EassosSoftware/\"\n Pattern match: \"https://www.youtube.com/user/EassosLtd\"\n Pattern match: \"https://twitter.com/Eassos_software\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"Facebook\" (Indicator: \"facebook.com\")\n \"Youtube\" (Indicator: \"youtube\")\n \"Twitter\" (Indicator: \"twitter\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"DiskGenius.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"DGEngSetup5431342.tmp\" opened \"\\Device\\KsecDD\"\n \"DiskGenius.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"IEXPLORE.EXE\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"Support QEMU virtual disk format (.qcow file).\" (Indicator: \"qemu\")\n \"HD0;vBoxHARDD_s_(100GB)\" (Indicator: \"vbox\")\n \"M0del:VBOXHARDDISK\" (Indicator: \"vbox\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"DiskGenius.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"IEXPLORE.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"DGEngSetup5431342.tmp\" read file \"%WINDIR%\\win.ini\"\n \"DGEngSetup5431342.tmp\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"DGEngSetup5431342.tmp\" read file \"%PROGRAMFILES%\\desktop.ini\"\n \"DGEngSetup5431342.tmp\" read file \"%PROGRAMFILES%\\(x86)\\desktop.ini\"\n \"DGEngSetup5431342.tmp\" read file \"C:\\Users\\desktop.ini\"\n \"DiskGenius.exe\" read file \"%PROGRAMFILES%\\DiskGenius\\Options.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"is-T2DL8.tmp\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"is-N9QIK.tmp\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"is-17QA1.tmp\" has type \"FREE-DOS executable (COM) UPX compressed\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 47.246.24.229 on port 443 is sent without HTTP header\n TCP traffic to 142.250.191.168 on port 443 is sent without HTTP header\n TCP traffic to 47.246.24.228 on port 443 is sent without HTTP header\n TCP traffic to 142.251.32.3 on port 80 is sent without HTTP header\n TCP traffic to 172.217.2.46 on port 80 is sent without HTTP header\n TCP traffic to 142.250.190.46 on port 443 is sent without HTTP header\n TCP traffic to 142.251.4.157 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"IEXPLORE.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\DGEngSetup5431342.exe\" marked \"%TEMP%\\is-OOH4B.tmp\\DGEngSetup5431342.tmp\" for deletion\n \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico\" for deletion\n \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\IEXPLORE.EXE\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\TBFHKZCA\\style[2].css\" for deletion\n \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\IEXPLORE.EXE\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\common[2].js\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"IEXPLORE.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"is-N9QIK.tmp\" claimed CRC 567723 while the actual is CRC 238980","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"FindFirstFileW\n GetFileAttributesW\n GetModuleFileNameA\n GetDriveTypeW\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n GetFileSizeEx\n FindFirstFileExA\n FindNextFileW\n DeleteFileW\n FindNextFileA\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n WriteFile\n CreateFileW\n IsDebuggerPresent\n GetFileSize\n GetModuleFileNameW\n FindFirstFileExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2e","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"DiskGenius.exe\" created file \"C:\"\n \"DiskGenius.exe\" created file \"Z:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"level":"malicious","category":"Environment Awareness","name":"Queries disc information (often used to evade virtual machines)","description":"\"DiskGenius.exe\" queried disc information using control code IOCTL_DISK_GET_LENGTH_INFO\n \"DiskGenius.exe\" queried disc information using control code IOCTL_DISK_GET_DRIVE_GEOMETRY_EX","origin":"API Call","mitre_attack_id":"T1120","relevance":5,"id":"api-48","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/67 Antivirus vendors marked spawned process \"DiskGenius.exe\" (PID: 1256) as malicious (classified as \"Trojan.Heur\" with 1% detection rate)\n 1/67 Antivirus vendors marked spawned process \"DiskGenius.exe\" (PID: 1320) as malicious (classified as \"Trojan.Heur\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"DGEngSetup5431342.tmp\" allocated memory in \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\"\n \"DGEngSetup5431342.tmp\" allocated memory in \"%PROGRAMFILES%\\DiskGenius\\unins000.exe\"\n \"DGEngSetup5431342.tmp\" allocated memory in \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\ieproxy.dll\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$30","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$31","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$32","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"DiskGenius.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode \"IOCTL_DISK_GET_LENGTH_INFO\" (0x7405c)\n \"DiskGenius.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode \"IOCTL_DISK_GET_DRIVE_GEOMETRY_EX\" (0x700a0)\n \"DiskGenius.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x74080\n \"DiskGenius.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x7c088\n \"DiskGenius.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400\n \"DiskGenius.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x70024\n \"DiskGenius.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x700f0\n \"DiskGenius.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x4d02c","origin":"API Call","mitre_attack_id":"T1542.003","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"DiskGenius.exe\" checked file \"C:\"\n \"DiskGenius.exe\" checked file \"Z:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"DGEngSetup5431342.tmp\" touched \"K:\"\n \"DGEngSetup5431342.tmp\" touched \"L:\"\n \"DGEngSetup5431342.tmp\" touched \"M:\"\n \"DGEngSetup5431342.tmp\" touched \"N:\"\n \"DGEngSetup5431342.tmp\" touched \"O:\"\n \"DGEngSetup5431342.tmp\" touched \"P:\"\n \"DGEngSetup5431342.tmp\" touched \"Q:\"\n \"DGEngSetup5431342.tmp\" touched \"R:\"\n \"DGEngSetup5431342.tmp\" touched \"S:\"\n \"DGEngSetup5431342.tmp\" touched \"T:\"\n \"DGEngSetup5431342.tmp\" touched \"U:\"\n \"DGEngSetup5431342.tmp\" touched \"V:\"\n \"DGEngSetup5431342.tmp\" touched \"W:\"\n \"DGEngSetup5431342.tmp\" touched \"X:\"\n \"DGEngSetup5431342.tmp\" touched \"Y:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to identify Internet Explorer version from registry","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\EXTENSION COMPATIBILITY\\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\"; Key: \"VERSION\"; Value: \"\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\EXTENSION COMPATIBILITY\\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\"; Key: \"VERSION\"; Value: \"\")","origin":"Registry Access","relevance":3,"id":"registry-103","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$34","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$35","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"is-GPHFU.tmp\" has an executable section named \".text\"\n \"is-VU7II.tmp\" has an executable section named \".text\"\n \"is-KVUNR.tmp\" has an executable section named \".text\"\n \"is-KVUNR.tmp\" has an executable section named \".itext\"\n \"is-0IAIT.tmp\" has an executable section named \".text\"\n \"is-6QFSH.tmp\" has an executable section named \".text\"\n \"is-I3KOP.tmp\" has an executable section named \".text\"\n \"is-U7P0D.tmp\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Network Related","name":"Found decrypted SSL traffic","description":"\"HTTP/1.1 302 Moved Temporarily\nContent-Length: 0\nServer: Kestrel\nLocation: https://www.msn.com/spartan/ientpgbconfig?locale=en-us&market=us\nRequest-Context: appId=cid-v1:9b037ab9-fa5a-4c09-81bd-41ffa859f01e\nX-Response-Cache-Status: True\nExpires: Mon, 04 Jul 2022 03:03:21 GMT\nCache-Control: max-age=0, no-cache, no-store\nPragma: no-cache\nDate: Mon, 04 Jul 2022 03:03:21 GMT\nConnection: keep-alive\nStrict-Transport-Security: max-age=31536000 ; includeSubDomains\"- [Source: SSL_96.7.73.215]","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline\" (Indicator: \"https://\") in Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 8.48.85.225 on port 443, \"HTTPS traffic to 8.25.82.229 on port 443\n \"HTTPS traffic to 96.7.73.215 on port 443","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"System Security","name":"Observed strings related to Windows privileges","description":"\"seshutdownprivilege\" observed seshutdownprivilege privilege string which can \"Shut down the system\" (Source: 6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12.bin\"","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"iexplore.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"iexplore.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"is-KVUNR.tmp\" was detected as \"Borland Delphi 4.0\"\n \"is-0IAIT.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-6QFSH.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-I3KOP.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"is-U7P0D.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"DiskGenius.exe\" at 00000000-00000996-00000105-10311204044951009\n \"DiskGenius.exe\" at 00000000-00000996-00000105-10311204062663063\n \"DiskGenius.exe\" at 00000000-00003992-00000105-25722970\n \"DiskGenius.exe\" at 00000000-00003992-00000105-10311204045072571","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"DGEngSetup5431342.tmp\" queried SystemProcessInformation at 00000000-00002520-00000105-43540459\n \"DGEngSetup5431342.tmp\" queried SystemProcessInformation at 00000000-00002520-00000105-43540954\n \"DiskGenius.exe\" queried SystemProcessInformation at 00000000-00000996-00000105-11755872\n \"DiskGenius.exe\" queried SystemProcessInformation at 00000000-00003992-00000105-10311204050722836","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"DiskGenius.exe\" is setting 'ThreadHideFromDebugger' data for thread ID 0xfffffffeL","origin":"API Call","mitre_attack_id":"T1036","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/64 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Fingerprint","details_count":8,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries disc information (often used to evade virtual machines)"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Queries physical drive (often used to detect virtual machines)"},{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Spreading","details_count":2,"details":[{"detail":"Tries to access unusual system drive letters"},{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":59,"imported_dlls_count":166,"dropped_files_count":0,"extracted_files_count":37,"files_written_count":62,"files_deleted_count":0,"registry_keys_created_count":114,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":121,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":4,"contacted_urls_count":7,"http_requests_count":7},"behavior_tags":["kryptik","stealer","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","Decrypted SSL traffic"],"sandbox_reports":[{"id":"62c2572a4827055c74371bf8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Crypt","contacted_countries":["USA"],"submit_name":"DGEngSetup5431342.exe","analysis_start_time":"2022-07-04T02:57:56+00:00","indicators_count":{"informative":41,"suspicious":26,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"6253530be64ce922ca165ac5","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"DGEngSetup5431342.exe","analysis_start_time":"2022-04-10T22:19:06+00:00","indicators_count":{"informative":31,"suspicious":27,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"47.246.24.229","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"address":"142.250.191.168","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"address":"47.246.24.228","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"address":"142.251.32.3","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"address":"172.217.2.46","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"address":"142.250.190.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"address":"142.251.4.157","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"address":"8.48.85.225","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"address":"8.25.82.229","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"address":"96.7.73.215","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]}],"dns_resolutions":[{"domain":"crl.pki.goog","address":"142.251.32.3","ttl":80,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"domain":"crls.pki.goog","address":"172.217.2.46","ttl":3073,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"domain":"internal.eassos.com","address":"47.246.24.228","ttl":600,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_name_servers":"NS13.DOMAINCONTROL.COM","registrar_creation_date":"2010-10-12T01:37:10+00:00","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"domain":"ocsp.pki.goog","address":"142.251.32.3","ttl":73,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]}],"http_requests":[{"host":"ocsp.pki.goog","host_ip":"142.251.32.3:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"host":"ocsp.pki.goog","host_ip":"142.251.32.3:80","url":"/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D","method":"GET","header":"GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"host":"crl.pki.goog","host_ip":"142.251.32.3:80","url":"/gtsr1/gtsr1.crl","method":"GET","header":"GET /gtsr1/gtsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"host":"crls.pki.goog","host_ip":"172.217.2.46:80","url":"/gts1c3/QOvJ0N1sT2A.crl","method":"GET","header":"GET /gts1c3/QOvJ0N1sT2A.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crls.pki.goog","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"host":"ocsp.pki.goog","host_ip":"142.251.32.3:80","url":"/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGYpOxyatdouCgAAAAE7fWo%3D","method":"GET","header":"GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGYpOxyatdouCgAAAAE7fWo%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"host":"ocsp.pki.goog","host_ip":"142.251.32.3:80","url":"/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECic8o4O65s0CgAAAAE7fWk%3D","method":"GET","header":"GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECic8o4O65s0CgAAAAE7fWk%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"host":"ocsp.pki.goog","host_ip":"142.251.32.3:80","url":"/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECT3LgFtm%2Bx0CgAAAAE7gBc%3D","method":"GET","header":"GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECT3LgFtm%2Bx0CgAAAAE7gBc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}],"processes":[{"pid":3160,"ppid":0,"name":"DGEngSetup5431342.exe","command_line":"","sha256":"6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12","normalized_path":"C:\\DGEngSetup5431342.exe","uid":"00000000-00003160","icon":"$36"},{"pid":3364,"ppid":3160,"name":"DGEngSetup5431342.tmp","command_line":"/SL5=\"$301C0,80722465,780800,C:\\DGEngSetup5431342.exe\"","sha256":"1c76bad56054cf041560ef6f8af701830e8c9ae0315f520fb6f02a653edc7d8a","normalized_path":"%TEMP%\\is-OOH4B.tmp\\DGEngSetup5431342.tmp","parent_uid":"00000000-00003160","uid":"00000000-00003364"},{"pid":1256,"ppid":3364,"name":"DiskGenius.exe","command_line":"","sha256":"cb6513badf9b347f90c8f4d4c18ab2883d8e7952e8a695160befe859f43a588d","normalized_path":"%PROGRAMFILES%\\DiskGenius\\DiskGenius.exe","parent_uid":"00000000-00003364","uid":"00000000-00001256"},{"pid":3272,"ppid":3364,"name":"iexplore.exe","command_line":"https://www.diskgenius.com/","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003364","uid":"00000000-00003272"},{"pid":4020,"ppid":3272,"name":"IEXPLORE.EXE","command_line":"SCODEF:3272 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\IEXPLORE.EXE","parent_uid":"00000000-00003272","uid":"00000000-00004020"},{"pid":1320,"ppid":3364,"name":"DiskGenius.exe","command_line":"","sha256":"cb6513badf9b347f90c8f4d4c18ab2883d8e7952e8a695160befe859f43a588d","normalized_path":"%PROGRAMFILES%\\DiskGenius\\DiskGenius.exe","parent_uid":"00000000-00003364","uid":"00000000-00001320"},{"pid":796,"ppid":3364,"name":"iexplore.exe","command_line":"https://www.diskgenius.com/","sha256":"c00b9f2b32828341a9185ae2be1a0649c9f503f0b5cccebc75be4c2f8c596530","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003364","uid":"00000000-00000796"},{"pid":2972,"ppid":796,"name":"IEXPLORE.EXE","command_line":"SCODEF:796 CREDAT:275457 /prefetch:2","sha256":"072041fa70bb351030c516e1b6f7f21d15495da158f3890826ba5b978af8900e","normalized_path":"%PROGRAMFILES%\\(x86)\\Internet Explorer\\IEXPLORE.EXE","parent_uid":"00000000-00000796","uid":"00000000-00002972"}],"all_imported_dlls":["ieframe.dll","FWPUCLNT.DLL","rasadhlp.dll","gpapi.dll","oledlg.dll","VxSSL64.dll","imm32.dll","psapi.dll","msvcr90.dll","ntdsapi.dll","nlaapi.dll","cryptnet.dll","ssv.dll","URLREDIR.DLL","msctf.dll","advapi32.dll","lpk.dll","rpcss.dll","mlang.dll","msimtf.dll","normaliz.dll","dhcpcsvc6.dll","wshqos.dll","ole32.dll","netmsg.dll","msftedit.dll","oleaccrc.dll","netprofm.dll","SensApi.dll","wow64win.dll","msvcp90.dll","ATL90.dll","RpcRtRemote.dll","mscoreei.dll","wininet.dll","ntshrui.dll","rsaenh.dll","IPHLPAPI.DLL","ieui.dll","msvcr100.dll","jscript9.dll","ntdll.dll","apphelp.dll","fltLib.dll","bcrypt.dll","msvcp110.dll","msvcr110.dll","credssp.dll","winmm.dll","wbemprox.dll","npmproxy.dll","d3d11.dll","srvcli.dll","sspicli.dll","EhStorShell.dll","Wldap32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","version.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wship6.dll","oleacc.dll","mscorwks.dll","linkinfo.dll","cscapi.dll","wbemcomn.dll","fastprox.dll","clbcatq.dll","msasn1.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","gdi32.dll","netapi32.dll","cfgmgr32.dll","propsys.dll","sfc.dll","mswsock.dll","sqmapi.dll","dhcpcsvc.dll","user32.dll","mpr.dll","sfc_os.dll","cryptsp.dll","wbemsvc.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","jp2ssv.dll","t2embed.dll","msvcrt.dll","shfolder.dll","bcryptprimitives.dll","xmllite.dll","devobj.dll","imagehlp.dll","secur32.dll","d3d10warp.dll","wkscli.dll","comctl32.dll","winsta.dll","GrooveIntlResource.dll","winnsi.dll","wintrust.dll","IEShims.dll","wow64cpu.dll","nsi.dll","uxtheme.dll","wsock32.dll","oleaut32.dll","wtsapi32.dll","deploy.dll","netutils.dll","sxs.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","mshtml.dll","KernelBase.dll","imageres.dll","WSHTCPIP.DLL","usp10.dll","RstrtMgr.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","dnsapi.dll","kernel32.dll","iertutil.dll","GROOVEEX.DLL","api-ms-win-downlevel-ole32-l1-1-0.dll","GdiPlus.dll","d2d1.dll","shell32.dll","urlmon.dll","ieproxy.dll","msimg32.dll","wow64.dll","profapi.dll","ncrypt.dll","winhttp.dll","setupapi.dll","devrtl.dll","api-ms-win-core-synch-l1-2-0.dll","MSOHEV.DLL","webio.dll","tiptsf.dll","crypt32.dll","mscoree.dll","shlwapi.dll","WindowsCodecs.dll","FileSyncShell.dll","Telemetry.dll","ExplorerFrame.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","slc.dll","dxgi.dll","rpcrt4.dll","cryptbase.dll","schannel.dll","powrprof.dll","DWrite.dll","SwDir_1231201.dll","npctrl.dll","sechost.dll","ws2_32.dll","dwmapi.dll","comdlg32.dll","LoggingPlatform.dll","cabinet.dll","userenv.dll","duser.dll","ntmarta.dll","dui70.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-T2DL8.tmp","sha256":"1afd807db55ee9faeedfed246ed88bc215d8bb57e47080af9326c43f1edaab3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"is-N9QIK.tmp","sha256":"996493be72964317bdac4cf2d96328387c7532d194e2c57fe7b845bf7cea9066","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"is-17QA1.tmp","sha256":"81872ee962d6143f52f97e32e10366dcd0177856b36cec978beb7132be65d6f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"5DQ0BCLM.htm","sha256":"28475d54eb0f81517b82b5714f62936a87fdba9b7892cf32646a50c0e07b68cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"DiskGenius.lnk","sha256":"674cfa65581437be37a9a21b3b87e7948c071b08a831b019d8e46dd2ed7c178b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Uninstall DiskGenius.lnk","sha256":"51028cd5e12f2f96794547a79f14b3f2c6d6699b1a7c7a53e5288a236b4f9ceb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Run DiskGenius.lnk","sha256":"f199af556ebc0ec6850e4d4b71ecd3f7f1237d5d10f6c88873cdbf89891fb49a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"urlref_httpswww.diskgenius.com","sha256":"28475d54eb0f81517b82b5714f62936a87fdba9b7892cf32646a50c0e07b68cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"idx_banner_1_.jpg","sha256":"6e0ab4e9d9519acb6c6bf302036ac04d4e55689fc4c6945e0063dab033f398ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"partition-management-108-100_1_.png","sha256":"7e4d37c03692e080a622299c9bc6a213c7c9d8ddc3c51a6bdda7ad24b716c605","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"idx_22_1_.png","sha256":"ec0be7f524dbfed514e74010273bf5b89c74bd20855b76c46cf035f507fb9ffc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"idx-clients_1_.png","sha256":"66191a851c05c307ea157248f2308667df2e389c3bc4ee9fffc4c0eada154166","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"idx_16_1_.png","sha256":"cdda0de47c5b27225cb1f0b75e87fb8cda3b1d7cdc9e56344df858159f48313c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA","sha256":"7e54be0791c11ce325f33bba2dd9e733060e9b018e340ef587bf6c6df800ad75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"unins000.dat","sha256":"b2e76205f85fd21bbcf3126e975d9db2b3486e9a8e5c83b17ebd4ed489bc6179","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"_A7ADF4A9-B90C-11EC-9844-08002754227E_.dat","sha256":"c471f423b1a852c51fb8cca68a5e7a4d038c51be0250de19d5607aad9ca940d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"ft_bg_1_.png","sha256":"e345dec180cea94b8a3511c8197ccc8468f7f97d08e5dc33eca924e8423b7844","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"F2DDCD2B5F37625B82E81F4976CEE400_0E9C76115DBFA86C8F9457BCE000B4BF","sha256":"2da9a001aa7e850165e3ff899584eefead9afa566c273503814246738970f35d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"DiskGenius on the Web.url","sha256":"ba95bd445c8323eb59ed2ca1162eb3f550a6435d6053b65317abdd3c29c825aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"040Z29TG.txt","sha256":"56cfd76001ffb9d1db0d45e0a79c9fec655efcdf0b9c603dca33cb41ca090dd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"0S7LAOFI.txt","sha256":"4d009c692d5a256c14571281c0511cdaa445c4c66b6186a782efe065ff27b9e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"1CWNPO4U.txt","sha256":"0dc85a05f6e6f2ffc4c3c80df7af0f5b9829be41ede642e6aac9033eabb8e196","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"2YX8ZD4N.txt","sha256":"a5e20b5407e2d7be291d2bfa10fa420c81c372b0febf4420a53a59c60f6f6d6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"JOLWQMOE.txt","sha256":"506dc3d89d798ccc25f88727f3f25ddb4d7b883e86de72eb291e5d82b02fd413","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"JX3W7QVF.txt","sha256":"22fb149d2960d0add998e4e7f7705f96bae0a9ccb8d2fe1e82c20a54cc164c30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"KWO2SA3C.txt","sha256":"611112d39d2b01d40d7804af058c5b53d82f6e3c9b46d226c81f0b1bf684030a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"O1SG69KZ.txt","sha256":"daaec30f9f546b82a16a28e08b79cf526fc90fc23bfe604b3dcd65bf1db1b930","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"P16W3VF6.txt","sha256":"d96282dace43a5586a71e531169608d1fd1ab91ad50dad23f7de90c704f7b862","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"RRMS3IYW.txt","sha256":"3650366694f122be9ba09cd1cb54b472cbd301d333660a30a41913779ee59ef4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"THRWHT9T.txt","sha256":"62c61823fe03d505ff8c335a1add44c40d4be72f5cd260656f492fba9af9a9fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"en-US.4","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sha256":"ad136c9cf8ce7f7a6f3b71924820f7d89913ee9702a82f2bc963c60a51676ec5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53","sha256":"c103f3c95d4807b4c00528b8838ba7590442abcecc327573d288f39a24e13448","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sha256":"2df57a476a8bc784f038eac98e9030161362f2a75df65b906780a690877962da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Options.ini","sha256":"6084d7dfb3e72ae02378bbf77f42e43667a68ef97ce61be66c4ab068a1fd8d3e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"is-33CG6.tmp","sha256":"a0241fa63953511ab85a5616efb3b8b2aa354a1bb5f783c6769846a17d8e0473","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]}],"files_written":[{"path":"\\\\?\\Volume{e47f4f43-d86","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"path":"\\\\?\\Volume{dcbfaac3-d86","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%USERPROFILE%\\Saved Games","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\is-VU7II.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\dos\\is-P46RE.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\is-6HAN9.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%TEMP%\\~DF4E37E41F368B04EE.TMP","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{7F103DBF-FB35-11EC-B52B-08002721EAAA}.dat","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%TEMP%\\~DFE28DEBDFE743B172.TMP","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\is-SGQLT.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\is-677NL.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\dos\\is-JI4A6.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\dos\\is-MQBJQ.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\dos\\is-IBIL1.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\dos\\is-7T0OB.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\dos\\is-54AHF.tmp","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\DiskGenius\\Run DiskGenius.lnk","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\DiskGenius\\DiskGenius on the Web.url","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\DiskGenius\\Uninstall DiskGenius.lnk","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PUBLIC%\\Desktop\\DiskGenius.lnk","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\unins000.msg","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%PROGRAMFILES%\\DiskGenius\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{60BAA66B-FB35-11EC-B52B-08002721EAAA}.dat","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%TEMP%\\~DFA0BD72556B3EFC11.TMP","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{80594243-FB35-11EC-B52B-08002721EAAA}.dat","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%TEMP%\\~DF3569682287F2D16B.TMP","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JOLWQMOE.txt","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2YX8ZD4N.txt","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P16W3VF6.txt","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JX3W7QVF.txt","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\040Z29TG.txt","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.4","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\KWO2SA3C.txt","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\search[1].json","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\search[2].json","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SHELL EXTENSIONS\\CACHED\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0002\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\STATS\\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\\IEXPLORE\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TOOLBAR\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cc8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3272","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"IsoScope_cc8_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"IsoScope_cc8_IE_EarlyTabStart_0xe50_Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"IsoScope_cc8_ConnHashTable<3272>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3272","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cc8_IE_EarlyTabStart_0xe50_Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cc8_ConnHashTable<3272>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"},{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cc8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"IsoScope_31c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"IsoScope_31c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"IsoScope_31c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"IsoScope_31c_IE_EarlyTabStart_0x378_Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_796","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"IsoScope_31c_ConnHashTable<796>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"IsoScope_cc8_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_31c_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_796","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_31c_IE_EarlyTabStart_0x378_Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_31c_ConnHashTable<796>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_31c_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_31c_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"IsoScope_31c_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_31c_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6253530be64ce922ca165ac5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2800","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_af0_IE_EarlyTabStart_0x438_Mutex","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_af0_ConnHashTable<2800>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2800","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"IsoScope_af0_ConnHashTable<2800>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"IsoScope_af0_IE_EarlyTabStart_0x438_Mutex","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"IsoScope_ee0_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3808","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"IsoScope_ee0_ConnHashTable<3808>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"IsoScope_ee0_IE_EarlyTabStart_0xef8_Mutex","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_ee0_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"62c2572a4827055c74371bf8"}]}]}},"report_ids":{"sandbox_job_ids":["62c2572a4827055c74371bf8","6253530be64ce922ca165ac5"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious App/DiskGen Sample 6ed944b35637… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6ed944b35637…. Malware family: App/DiskGen. Threat score 100/100. 1/26 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12"}],["$","meta","4",{"property":"og:title","content":"Malicious App/DiskGen Sample 6ed944b35637… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6ed944b35637…. Malware family: App/DiskGen. Threat score 100/100. 1/26 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6ed944b3563731c8c4fc5bfb8034fb9ac3adc598ec9261365f36e19502f66c12"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious App/DiskGen Sample 6ed944b35637… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6ed944b35637…. Malware family: App/DiskGen. Threat score 100/100. 1/26 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]